#! /usr/bin/ksh # # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License (the "License"). # You may not use this file except in compliance with the License. # # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # When distributing Covered Code, include this CDDL HEADER in each # file and include the License file at usr/src/OPENSOLARIS.LICENSE. # If applicable, add the following below this CDDL HEADER, with the # fields enclosed by brackets "[]" replaced with your own identifying # information: Portions Copyright [yyyy] [name of copyright owner] # # CDDL HEADER END # # # Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. # # # inityp2l -- Utility to generate YP (NIS) to LDAP # configuration file (/etc/default/ypserv) # and mapping file (/var/yp/NISLDAPmapping) # # # Displays message corresponding to the argument tag passed. # display_msg() { case "$1" in usage) cat < Name of the generated NISLDAP mapping file Default is /var/yp/NISLDAPmapping c Name of the generated ypserv configuration file Default is /etc/default/ypserv EOF ;; no_config_file_name_specified) cat < /dev/null 2>&1 if [ $? -ge 2 ]; then return 1 fi # Made it here, it's Numeric. return 0 } # # not_integer(): Reverses the return values of is_integer. Useful # for if and while statements that want to test for # non-integer data. # 0 = NOT Integer # 1 = Integer # not_integer() { is_integer $1 if [ $? -eq 0 ]; then return 1 else return 0 fi } # # is_numeric(): Tells if a string is numeric. # 0 = Numeric # 1 = NOT Numeric # is_numeric() { # Check for parameter. if [ $# -ne 1 ]; then return 1 fi # Determine if numeric. let _NUM="$1 + 1" > /dev/null 2>&1 if [ $? -eq 0 ]; then return 0 fi } # # not_numeric(): Reverses the return values of is_numeric. Useful # for if and while statements that want to test for # non-numeric data. # 0 = NOT Numeric # 1 = Numeric # not_numeric() { is_numeric $1 if [ $? -eq 0 ]; then return 1 else return 0 fi } # # domain_2_dc(): Convert a domain name into dc string. # $1 .. Domain name. # domain_2_dc() { _DOM=$1 # Domain parameter. _DOM_2_DC="" # Return value from function. _FIRST=1 # Flag for first time. export _DOM_2_DC # Make visible for others. # Convert "."'s to spaces for "for" loop. domtmp="`echo ${_DOM} | tr '.' ' '`" for i in $domtmp; do if [ $_FIRST -eq 1 ]; then _DOM_2_DC="dc=${i}" _FIRST=0 else _DOM_2_DC="${_DOM_2_DC},dc=${i}" fi done } # # is_root_user(): Check to see if logged in as super user. # is_root_user() { case `id` in uid=0\(root\)*) return 0 ;; * ) return 1 ;; esac } # # parse_arg(): Parses the command line arguments and sets the # appropriate variables. # parse_arg() { while getopts ":dm:c:" ARG do case $ARG in d) DEBUG=1;; m) MAP_FILE=$OPTARG MAPPING_FILE_SPECIFIED=1;; c) CONFIG_FILE=$OPTARG CONFIG_FILE_SPECIFIED=1;; \?) echo "**ERROR: Invalid option '$OPTARG'" display_msg usage exit 1;; esac done shift `expr $OPTIND - 1` if [ $# -gt 0 ]; then echo "**ERROR: wrong usage " display_msg usage exit 1 fi } # # present() : Checks if the first argument exists in the # argument list. Returns 0 if found, else 1. # present () { _ELEMENT=$1 shift ARG_LIST=$@ for item in $ARG_LIST do [ "$_ELEMENT" = "$item" ] && return 0 done # If reached here, then the clement does not exist return 1 } # # remove() : Returns a new string after removing the first # argument in the argument list. # remove () { _ELEMENT=$1 shift ARG_LIST=$@ NEW_LIST="" for item in $ARG_LIST do [ "$_ELEMENT" != "$item" ] && NEW_LIST="$NEW_LIST $item" done echo $NEW_LIST return 0 } # # merge_lists() : Returns a list after merging elements # (uniquely) supplied in the argument list. # merge_lists() { MERGED_LIST="" for _VAR in "$@" do if ! present $_VAR $MERGED_LIST; then MERGED_LIST="$MERGED_LIST $_VAR" fi done echo $MERGED_LIST return 0 } # # init(): initializes variables and options # init() { # General variables. DEBUG=0 # Set Debug OFF MAPPING_FILE_SPECIFIED=0 # No file name passed CONFIG_FILE_SPECIFIED=0 # No file name passed # Prevent others from snooping umask 077 # Set default config and mapping files. DEFAULT_MAP_FILE="/var/yp/NISLDAPmapping" DEFAULT_CONFIG_FILE="/etc/default/ypserv" MAP_FILE="$DEFAULT_MAP_FILE" CONFIG_FILE="$DEFAULT_CONFIG_FILE" # Set and create TMPDIR. Use a safe place to discourage hackers. TMPDIR="/var/yp/inityp2l" # Temporary file names to be used to prevent system starting in # N2L mode in case something goes wrong during file creation. TMPCONF="ypserv-tmp" TMPMAP="NISLDAPmapping-tmp" # Remove if the temp directory has been leftover [ -d "$TMPDIR" ] && rm -rf $TMPDIR mkdir $TMPDIR if [ $? -ne 0 ]; then echo ERROR : Failed to create temp directory $TMPDIR exit 1 fi # Initialize the default NIS maps. DEFAULT_NIS_MAPS="passwd.byname passwd.byuid group.byname group.bygid hosts.byaddr hosts.byname ipnodes.byaddr ipnodes.byname ethers.byaddr ethers.byname networks.byaddr networks.byname rpc.bynumber services.byname services.byservicename printers.conf.byname project.byname project.byprojid protocols.byname protocols.bynumber netgroup netgroup.byuser netgroup.byhost bootparams mail.aliases mail.byaddr publickey.byname netid.byname netmasks.byaddr passwd.adjunct.byname group.adjunct.byname timezone.byname auth_attr exec_attr prof_attr user_attr audit_user auto.master auto.home ypservers" set -A DEF_NIS_MAP_ARRAY $DEFAULT_NIS_MAPS # The default TTL maps in database ID format. DEF_TTL_MAPLIST="audit_user auto.home auto.master auth_attr bootparams ethers exec_attr group group.adjunct.byname keys.host keys.pass keys.nobody hosts multihosts ipnodes multiipnodes netgroup networks passwd passwd.adjunct.byname printers.conf.byname prof_attr project protocols services mail.aliases mail.mapping netid.host netid.pass netmasks.byaddr rpc.bynumber ageing.byname timezone.byname user_attr ypservers" # Initialize default values for config parameters. configDN_flag=0 DEF_nisLDAPconfigDN="" DEF_TLS=none DEF_TLSCertificateDBPath=/var/yp/ DEF_nisLDAPbindTimeout=15 DEF_nisLDAPsearchTimeout=180 DEF_nisLDAPmodifyTimeout=15 DEF_nisLDAPaddTimeout=15 DEF_nisLDAPdeleteTimeout=15 DEF_nisLDAPsearchTimeLimit=${DEF_nisLDAPsearchTimeout} DEF_nisLDAPsearchSizeLimit=0 DEF_nisLDAPfollowReferral=no DEF_nisLDAPretrieveErrorAction=use_cached # The default is unlimited, but since it prevents the NIS daemon, # from servicing further requests, set 1 as the suggested value. SUG_nisLDAPretrieveErrorAttempts=1 DEF_nisLDAPretrieveErrorTimeout=15 DEF_nisLDAPstoreErrorAction=retry # The default is unlimited, but set 1 as the suggested value. SUG_nisLDAPstoreErrorAttempts=1 DEF_nisLDAPstoreErrorTimeout=15 # Default TTL values (in seconds) for NIS MAPS for mapping file. DEF_iTTLlo=1800 DEF_iTTLhi=5400 DEF_runTTL=3600 } # # config_auth_menu_handler(): Enter the authentication method # for config server. # config_auth_menu_handler() { # Display Auth menu display_msg config_auth_method_menu # Get a Valid choice. while : do # Display appropriate prompt and get answer. get_ans_req " Choose one Authentication Method (h=help):" # Determine choice. _MENU_CHOICE=$ANS case "$_MENU_CHOICE" in 1) _AUTHMETHOD="none" break ;; 2) _AUTHMETHOD="simple" break ;; 3) _AUTHMETHOD="sasl/cram-md5" break ;; 4) _AUTHMETHOD="sasl/digest-md5" break ;; h) display_msg auth_help ;; *) echo "Please enter 1-4, or h=help." ;; esac done } # # auth_menu_handler(): Enter the Authentication method for LDAP server. # auth_menu_handler() { # Display Auth menu display_msg auth_method_menu # Get a Valid choice. while : do # Display appropriate prompt and get answer. get_ans_req " Choose one Authentication Method (h=help):" # Determine choice. _MENU_CHOICE=$ANS case "$_MENU_CHOICE" in 1) _AUTHMETHOD="simple" break ;; 2) _AUTHMETHOD="sasl/cram-md5" break ;; 3) _AUTHMETHOD="sasl/digest-md5" break ;; h) display_msg auth_help ;; *) echo "Please enter 1-3, or h=help." ;; esac done } # # tls_menu_handler(): Enter the transport layer security # tls_menu_handler() { # Display TLS menu display_msg tls_method_menu # Get a Valid choice. while : do # Display appropriate prompt and get answer. # Default value is "none". get_ans " Choose one Transport Layer Security Method (h=help):" "1" # Determine choice. _MENU_CHOICE=$ANS case "$_MENU_CHOICE" in 1) _TLSMETHOD="none" break ;; 2) _TLSMETHOD="ssl" break ;; h) display_msg tls_help ;; *) echo "Please enter 1, 2, or h=help." ;; esac done } # # retrieve_error_action_menu_handler(): Enter the retrieve error action # retrieve_error_action_menu_handler() { # Display retrieve error action menu display_msg retrieve_error_action_menu # Get a Valid choice. while : do # Display appropriate prompt and get answer. use_cached is default get_ans " Choose one retrieval error action (h=help):" "1" # Determine choice. _MENU_CHOICE=$ANS case "$_MENU_CHOICE" in 1) _RET_ERR_ACT="use_cached" break ;; 2) _RET_ERR_ACT="fail" break ;; h) display_msg nisLDAPretrieveErrorAction_help ;; *) echo "Please enter 1, 2, or h=help." ;; esac done } # # store_error_action_menu_handler(): Enter the store error action # store_error_action_menu_handler() { # Display store error action menu display_msg store_error_action_menu # Get a Valid choice. while : do # Display appropriate prompt and get answer. retry is default get_ans " Choose one store error action (h=help):" "1" # Determine choice. _MENU_CHOICE=$ANS case "$_MENU_CHOICE" in 1) _STOR_ERR_ACT="retry" break ;; 2) _STOR_ERR_ACT="fail" break ;; h) display_msg nisLDAPstoreErrorAction_help ;; *) echo "Please enter 1, 2, or h=help." ;; esac done } # # cleanup(): Remove the TMPDIR and all files in it. # cleanup() { [ $DEBUG -eq 1 ] && echo "In cleanup()" # Leave the temp directory if debug is set [ $DEBUG -eq 0 ] && rm -rf $TMPDIR } # Save existing config file if elected check_back_config_file() { if [ -f $CONFIG_FILE ]; then display_msg backup_config_file get_confirm "Do you wish to continue (y/n/h)?" \ "n" "backup_config_file_cont_help" if [ $? -eq 0 ]; then # if No, cleanup and exit. cleanup ; exit 1 fi get_confirm "Do you wish to backup the config file "${CONFIG_FILE}" (y/n/h)?" \ "y" "backup_config_file_help" if [ $? -eq 1 ]; then # Save the old config file with timestamp # SCCS converts '% H %' (without spaces) in current date during putback. # So use some other combination. SUFFIX=`date '+%d%h%Y.%H:%M:%S'` cp -p $CONFIG_FILE ${CONFIG_FILE}-${SUFFIX} echo " Saved existing $CONFIG_FILE as ${CONFIG_FILE}-${SUFFIX}" fi fi } # Save existing mapping file if elected check_back_mapping_file() { if [ -f $MAP_FILE ]; then display_msg backup_mapping_file get_confirm "Do you wish to continue (y/n/h)?" \ "n" "backup_mapping_file_cont_help" if [ $? -eq 0 ]; then # if No, cleanup and exit. cleanup ; exit 1 fi get_confirm "Do you wish to backup the map file "${MAP_FILE}" (y/n/h)?" \ "y" "backup_mapping_file_help" if [ $? -eq 1 ]; then # if Yes, save the old map file with timestamp # SCCS converts '% H %' (without spaces) in current date during putback. # So use some other combination. SUFFIX=`date '+%d%h%Y.%H:%M:%S'` cp -p $MAP_FILE ${MAP_FILE}-${SUFFIX} echo " Saved existing $MAP_FILE as ${MAP_FILE}-${SUFFIX}" fi else if [ "$MAP_FILE" = "$DEFAULT_MAP_FILE" ]; then display_msg warn_n2l_mode get_confirm "Do you wish to continue (y/n/h)?" \ "n" "warn_n2l_mode_help" if [ $? -eq 0 ]; then cleanup ; exit 1 fi fi fi } put_config_file_copyright_info() { # Start with an empty file, so don't append, but overwrite here. # Just change the name, but keep the same date and version number # as in the ident string of this script. grep "ident \"@(#)$PROG" $ABS_PROG | \ sed "s/${PROG}/${NEW_NAME}/g" > $CONFIG_FILE echo "\ # # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License (the "License"). # You may not use this file except in compliance with the License. # # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # When distributing Covered Code, include this CDDL HEADER in each # file and include the License file at usr/src/OPENSOLARIS.LICENSE. # If applicable, add the following below this CDDL HEADER, with the # fields enclosed by brackets "[]" replaced with your own identifying # information: Portions Copyright [yyyy] [name of copyright owner] # # CDDL HEADER END # # # Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. #\ " >> $MAP_FILE } get_nisLDAPconfigDN() { while : do get_ans "DN for configuration information (h=help):" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg nisLDAPconfigDN_help ;; * ) break ;; esac done nisLDAPconfigDN="${ANS}" # Store in config file only if a non-default value is specified. if [ "$ANS" != "${DEF_nisLDAPconfigDN}" ]; then echo "nisLDAPconfigDN=${ANS}" >> $CONFIG_FILE fi # Ask remaining config server related questions only if this # DN is set. So, if a value is specified, set a flag. [ "$ANS" != "" ] && configDN_flag=1 } get_nisLDAPconfigPreferredServerList() { while : do get_ans_req "Preferred server list for configuration information (h=help):" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg nisLDAPconfigPreferredServerList_help ;; * ) break ;; esac done nisLDAPconfigPreferredServerList=${ANS} echo "nisLDAPconfigPreferredServerList=${ANS}" >> $CONFIG_FILE } get_nisLDAPconfigAuthenticationMethod() { _AUTHMETHOD="" echo "Select the Authentication Method for configuration server :" config_auth_menu_handler nisLDAPconfigAuthenticationMethod=${_AUTHMETHOD} echo "nisLDAPconfigAuthenticationMethod=${_AUTHMETHOD}" >> $CONFIG_FILE } get_nisLDAPconfigTLS() { _TLSMETHOD="" echo "Select the Transport Layer Security (TLS) for configuration server :" tls_menu_handler nisLDAPconfigTLS=${_TLSMETHOD} # Store in config file only if a non-default value is specified. if [ "${_TLSMETHOD}" != "${DEF_TLS}" ]; then echo "nisLDAPconfigTLS=${_TLSMETHOD}" >> $CONFIG_FILE fi } get_nisLDAPconfigTLSCertificateDBPath() { while : do get_ans "Path with TLS Certificate DB for configuration server (h=help):"\ "${DEF_TLSCertificateDBPath}" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg TLSCertificateDBPath_help ;; * ) break ;; esac done nisLDAPconfigTLSCertificateDBPath=${ANS} # Store in config file only if a non-default value is specified. if [ "$ANS" != "${DEF_TLSCertificateDBPath}" ]; then echo "nisLDAPconfigTLSCertificateDBPath=${ANS}" >> $CONFIG_FILE fi } get_nisLDAPconfigProxyUser() { while : do get_ans_req "Proxy user bind DN to obtain configuration information (h=help):" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg nisLDAPconfigProxyUser_help ;; * ) break ;; esac done nisLDAPconfigProxyUser=${ANS} echo "nisLDAPconfigProxyUser=${ANS}" >> $CONFIG_FILE } get_nisLDAPconfigProxyPassword() { get_passwd "Proxy user password to obtain configuration information :" nisLDAPconfigProxyPassword=${ANS} echo "nisLDAPconfigProxyPassword=${ANS}" >> $CONFIG_FILE display_msg ProxyPassword_warn } get_preferredServerList() { while : do get_ans_req "Preferred server list for mapping data to/from LDAP (h=help):" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg preferredServerList_help ;; * ) break ;; esac done preferredServerList=${ANS} echo "preferredServerList=${ANS}" >> $CONFIG_FILE } get_authenticationMethod() { _AUTHMETHOD="" echo "Select the Authentication Method for mapping data to/from LDAP :" auth_menu_handler authenticationMethod=${_AUTHMETHOD} echo "authenticationMethod=${_AUTHMETHOD}" >> $CONFIG_FILE } get_nisLDAPTLS() { _TLSMETHOD="" echo "Select the Transport Layer Security (TLS) for mapping data to/from LDAP :" tls_menu_handler nisLDAPTLS=${_TLSMETHOD} # Store in config file only if a non-default value is specified. if [ "${_TLSMETHOD}" != "${DEF_TLS}" ]; then echo "nisLDAPTLS=${_TLSMETHOD}" >> $CONFIG_FILE fi } get_nisLDAPTLSCertificateDBPath() { while : do get_ans "Path with TLS Certificate DB for LDAP data server (h=help):"\ "${DEF_nisLDAPTLSCertificateDBPath}" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg TLSCertificateDBPath_help ;; * ) break ;; esac done nisLDAPTLSCertificateDBPath=${ANS} # Store in config file only if a non-default value is specified. if [ "$ANS" != "${DEF_TLSCertificateDBPath}" ]; then echo "nisLDAPTLSCertificateDBPath=${ANS}" >> $CONFIG_FILE fi } get_nisLDAPproxyUser() { while : do get_ans_req "Proxy user bind DN to read/write data from/to LDAP (h=help):" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg nisLDAPproxyUser_help ;; * ) break ;; esac done nisLDAPproxyUser=${ANS} echo "nisLDAPproxyUser=${ANS}" >> $CONFIG_FILE } get_nisLDAPproxyPassword() { get_passwd "Proxy user password to read/write data from/to LDAP :" nisLDAPproxyPassword=${ANS} echo "nisLDAPproxyPassword=${ANS}" >> $CONFIG_FILE display_msg ProxyPassword_warn } get_nisLDAPbindTimeout() { get_pos_int "Timeout value (in seconds) for LDAP bind operation (h=help):" \ "${DEF_nisLDAPbindTimeout}" "nisLDAPbindTimeout_help" nisLDAPbindTimeout=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPbindTimeout} ]; then echo "nisLDAPbindTimeout=${NUM}" >> $CONFIG_FILE fi } get_nisLDAPsearchTimeout() { get_pos_int "Timeout value (in seconds) for LDAP search operation (h=help):" \ "${DEF_nisLDAPsearchTimeout}" "nisLDAPsearchTimeout_help" nisLDAPsearchTimeout=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPsearchTimeout} ]; then echo "nisLDAPsearchTimeout=${NUM}" >> $CONFIG_FILE fi } get_nisLDAPmodifyTimeout() { get_pos_int "Timeout value (in seconds) for LDAP modify operation (h=help):" \ "${DEF_nisLDAPmodifyTimeout}" "nisLDAPmodifyTimeout_help" nisLDAPmodifyTimeout=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPmodifyTimeout} ]; then echo "nisLDAPmodifyTimeout=${NUM}" >> $CONFIG_FILE fi } get_nisLDAPaddTimeout() { get_pos_int "Timeout value (in seconds) for LDAP add operation (h=help):" \ "${DEF_nisLDAPaddTimeout}" "nisLDAPaddTimeout_help" nisLDAPaddTimeout=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPaddTimeout} ]; then echo "nisLDAPaddTimeout=${NUM}" >> $CONFIG_FILE fi } get_nisLDAPdeleteTimeout() { get_pos_int "Timeout value (in seconds) for LDAP delete operation (h=help):" \ "${DEF_nisLDAPdeleteTimeout}" "nisLDAPdeleteTimeout_help" nisLDAPdeleteTimeout=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPdeleteTimeout} ]; then echo "nisLDAPdeleteTimeout=${NUM}" >> $CONFIG_FILE fi } get_nisLDAPsearchTimeLimit() { get_pos_int "Time limit (in seconds) for search operation on LDAP server (h=help):" \ "${DEF_nisLDAPsearchTimeLimit}" "nisLDAPsearchTimeLimit_help" nisLDAPsearchTimeLimit=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPsearchTimeLimit} ]; then echo "nisLDAPsearchTimeLimit=${NUM}" >> $CONFIG_FILE fi } get_nisLDAPsearchSizeLimit() { get_pos_int "Size limit (in bytes) for search operation on LDAP server (h=help):" \ "${DEF_nisLDAPsearchSizeLimit}" "nisLDAPsearchSizeLimit_help" nisLDAPsearchSizeLimit=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPsearchSizeLimit} ]; then echo "nisLDAPsearchSizeLimit=${NUM}" >> $CONFIG_FILE fi } get_nisLDAPfollowReferral() { get_confirm "Should the ypserv follow LDAP referrals (y/n/h):" \ "n" "nisLDAPfollowReferral_help" if [ $? -eq 1 ]; then _ANS="yes" else _ANS="no" fi # Store in config file only if a non-default value is specified. if [ "${_ANS}" != "${DEF_nisLDAPfollowReferral}" ]; then echo "nisLDAPfollowReferral=${_ANS}" >> $CONFIG_FILE fi } get_nisLDAPretrieveErrorAction() { _RET_ERR_ACT="" echo "Select the action to be taken in case of LDAP retrieval error :" retrieve_error_action_menu_handler nisLDAPretrieveErrorAction=${_RET_ERR_ACT} # Store in config file only if a non-default value is specified. if [ "${_RET_ERR_ACT}" != "${DEF_nisLDAPretrieveErrorAction}" ]; then echo "nisLDAPretrieveErrorAction=${_RET_ERR_ACT}" >> $CONFIG_FILE fi } get_nisLDAPretrieveErrorAttempts() { get_pos_int "Number of attempts in case of LDAP retrieval error (h=help):" \ "$SUG_nisLDAPretrieveErrorAttempts" \ "nisLDAPretrieveErrorAttempts_help" nisLDAPretrieveErrorAttempts=${NUM} echo "nisLDAPretrieveErrorAttempts=${NUM}" >> $CONFIG_FILE } get_nisLDAPretrieveErrorTimeout() { # if nisLDAPretrieveErrorAttempts=0, then no point in asking # for timeout vales as it is ignored anyway. [ $nisLDAPretrieveErrorAttempts -eq 0 ] && return 0 get_pos_int "Timeout (in seconds) between each new attempt to retrieve LDAP data (h=help):"\ "${DEF_nisLDAPretrieveErrorTimeout}" \ "nisLDAPretrieveErrorTimeout_help" nisLDAPretrieveErrorTimeout=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPretrieveErrorTimeout} ]; then echo "nisLDAPretrieveErrorTimeout=${NUM}" >> $CONFIG_FILE fi } get_nisLDAPstoreErrorAction() { _STOR_ERR_ACT="" echo "Select the action to be taken in case of LDAP store error :" store_error_action_menu_handler nisLDAPstoreErrorAction=${_STOR_ERR_ACT} # Store in config file only if a non-default value is specified. if [ "${_STOR_ERR_ACT}" != "${DEF_nisLDAPstoreErrorAction}" ]; then echo "nisLDAPstoreErrorAction=${_STOR_ERR_ACT}" >> $CONFIG_FILE fi } get_nisLDAPstoreErrorAttempts() { # if nisLDAPstoreErrorAction="fail", then no point in asking # for no. of attempts or timeout vales as they are ignored. [ "$nisLDAPstoreErrorAction" = "fail" ] && return 0 get_pos_int "Number of attempts in case of LDAP store error (h=help):" \ "$SUG_nisLDAPstoreErrorAttempts" \ "nisLDAPstoreErrorAttempts_help" nisLDAPstoreErrorAttempts=${NUM} echo "nisLDAPstoreErrorAttempts=${NUM}" >> $CONFIG_FILE } get_nisLDAPstoreErrorTimeout() { # if nisLDAPstoreErrorAction="fail", then no point in asking # for no. of attempts or timeout vales as they are ignored. [ "$nisLDAPstoreErrorAction" = "fail" ] && return 0 # Similarly, if nisLDAPstoreErrorAttempts=0, ignore this question. [ $nisLDAPstoreErrorAttempts -eq 0 ] && return 0 get_pos_int "Timeout (in seconds) between each new attempt to write LDAP data (h=help):"\ "${DEF_nisLDAPstoreErrorTimeout}" \ "nisLDAPstoreErrorTimeout_help" nisLDAPstoreErrorTimeout=${NUM} # Store in config file only if a non-default value is specified. if [ $NUM -ne ${DEF_nisLDAPstoreErrorTimeout} ]; then echo "nisLDAPstoreErrorTimeout=${NUM}" >> $CONFIG_FILE fi } create_config_file() { # To prevent from leaving a partial config file in case some error or # signal takes place, store the output being generated in a temporary # file first, and move it at the final destination only at the end if # everything goes fine. _CONFIG_FILE=$CONFIG_FILE CONFIG_FILE=${TMPDIR}/${TMPCONF}.$$ echo "Generating config file temporarily as \"${CONFIG_FILE}\"" # Truncate the file before we append anything. # Place copyright information put_config_file_copyright_info # Filter out all the YP domains in /var/yp # The list of domains is stored in list "VARYP_DMN_LIST" echo "\ # # Configuration file for ypserv(8); see ypserv(5) for more information, # and NISLDAPmapping(5) for configuration of NIS to LDAP mapping. # Unless otherwise noted, commented lines show default values. " >> $CONFIG_FILE echo "\ # Where to look for configuration information in LDAP. Leave empty or # undefined to use this file, in which case the values of the other # 'nisLdapConfig*' attributes are ignored. # #nisLDAPconfigDN=\ " >> $CONFIG_FILE get_nisLDAPconfigDN echo " # Server(s) for configuration information. There is no default; # use the value on the line below for an LDAP server running on # this machine, at port 389. #nisLDAPconfigPreferredServerList=127.0.0.1:389\ " >> $CONFIG_FILE [ $configDN_flag -eq 1 ] && get_nisLDAPconfigPreferredServerList echo " # Authentication method(s) to obtain configuration information. #\ " >> $CONFIG_FILE [ $configDN_flag -eq 1 ] && get_nisLDAPconfigAuthenticationMethod echo " # Transport layer security for configuration information # #nisLDAPconfigTLS=${DEF_TLS}\ " >> $CONFIG_FILE [ $configDN_flag -eq 1 ] && get_nisLDAPconfigTLS echo " # Certificate DB for transport layer security # #nisLDAPconfigTLSCertificateDBPath=${DEF_TLSCertificateDBPath}\ " >> $CONFIG_FILE # ask for Certificate DB only if SSL is set if [ "${nisLDAPconfigTLS}" = "ssl" ]; then [ $configDN_flag -eq 1 ] && get_nisLDAPconfigTLSCertificateDBPath fi echo " # Proxy user(s) to obtain configuration information. The line below # is an example of the format. # #nisLDAPconfigProxyUser=cn=nisAdmin,ou=People,\ " >> $CONFIG_FILE # Ask proxy user bind DN only if needed. if [ "${nisLDAPconfigAuthenticationMethod}" != "none" ]; then [ $configDN_flag -eq 1 ] && get_nisLDAPconfigProxyUser fi echo " # Password for proxy user. Must be supplied if the authentication method # requires a password. If a password appears in this file, it should be # protected appropriately against access by unauthorized users. # #nisLDAPconfigProxyPassword=\ " >> $CONFIG_FILE if [ "${nisLDAPconfigAuthenticationMethod}" != "none" ]; then [ $configDN_flag -eq 1 ] && get_nisLDAPconfigProxyPassword fi echo " # Server list for mapping data to/from LDAP. There is no default; # use the value on the line below for an LDAP server running on # this machine, at port 389. #preferredServerList=127.0.0.1:389\ " >> $CONFIG_FILE get_preferredServerList echo " # Authentication method for mapping data to/from LDAP #\ " >> $CONFIG_FILE get_authenticationMethod echo " # Transport layer security for mapping data to/from LDAP. # #nisLDAPTLS=${DEF_TLS}\ " >> $CONFIG_FILE get_nisLDAPTLS echo " # Certificate DB for transport layer security # #nisLDAPTLSCertificateDBPath=${DEF_TLSCertificateDBPath}\ " >> $CONFIG_FILE # ask for Certificate DB only if SSL is set if [ "${nisLDAPTLS}" = "ssl" ]; then get_nisLDAPTLSCertificateDBPath fi echo " # Proxy user for ypserv. Assumed to have appropriate permission to read # and/or create or modify LDAP data. The line below is an example of the # format. # #nisLDAPproxyUser=cn=nisAdmin,ou=People,\ " >> $CONFIG_FILE # Ask proxy user bind DN only if needed. if [ "${authenticationMethod}" != "none" ]; then get_nisLDAPproxyUser fi echo " # Password for proxy user. Must be supplied if the authentication method # requires a password. If a password appears in this file, it should be # protected appropriately against unauthorized access. # #nisLDAPproxyPassword=\ " >> $CONFIG_FILE if [ "${authenticationMethod}" != "none" ]; then get_nisLDAPproxyPassword fi echo " # Timeouts and time/size limits for LDAP operations. # #nisLDAPbindTimeout=${DEF_nisLDAPbindTimeout}\ " >> $CONFIG_FILE get_nisLDAPbindTimeout echo " #nisLDAPsearchTimeout=${DEF_nisLDAPsearchTimeout}\ " >> $CONFIG_FILE get_nisLDAPsearchTimeout echo " #nisLDAPmodifyTimeout=${DEF_nisLDAPmodifyTimeout}\ " >> $CONFIG_FILE get_nisLDAPmodifyTimeout echo " #nisLDAPaddTimeout=${DEF_nisLDAPaddTimeout}\ " >> $CONFIG_FILE get_nisLDAPaddTimeout echo " #nisLDAPdeleteTimeout=${DEF_nisLDAPdeleteTimeout}\ " >> $CONFIG_FILE get_nisLDAPdeleteTimeout echo " #nisLDAPsearchTimeLimit=${DEF_nisLDAPsearchTimeLimit}\ " >> $CONFIG_FILE get_nisLDAPsearchTimeLimit echo " #nisLDAPsearchSizeLimit=${DEF_nisLDAPsearchSizeLimit}\ " >> $CONFIG_FILE get_nisLDAPsearchSizeLimit echo " # Should the ypserv follow LDAP referrals ? # #nisLDAPfollowReferral=${DEF_nisLDAPfollowReferral}\ " >> $CONFIG_FILE get_nisLDAPfollowReferral echo " # Action, number of attempts, and timeout following an LDAP retrieval error # #nisLDAPretrieveErrorAction=${DEF_nisLDAPretrieveErrorAction}\ " >> $CONFIG_FILE get_nisLDAPretrieveErrorAction echo " #nisLDAPretrieveErrorAttempts=\ " >> $CONFIG_FILE get_nisLDAPretrieveErrorAttempts echo " #nisLDAPretrieveErrorTimeout=${DEF_nisLDAPretrieveErrorTimeout}\ " >> $CONFIG_FILE get_nisLDAPretrieveErrorTimeout echo " # Action, number of attempts, and timeout following an LDAP store error # #nisLDAPstoreErrorAction=${DEF_nisLDAPstoreErrorAction}\ " >> $CONFIG_FILE get_nisLDAPstoreErrorAction echo " #nisLDAPstoreErrorAttempts=\ " >> $CONFIG_FILE get_nisLDAPstoreErrorAttempts echo " #nisLDAPstoreErrorTimeout=${DEF_nisLDAPstoreErrorTimeout}\ " >> $CONFIG_FILE get_nisLDAPstoreErrorTimeout # We are done, so move back the config file from temp. location # to actual location. # In case the config file name has a directory component which does # not exist, then create it now, otherwise 'mv' will return error. DIR_TO_CREATE=`dirname ${_CONFIG_FILE}` mkdir -p ${DIR_TO_CREATE} echo "Moving output from temporary file ($CONFIG_FILE) to actual file ($_CONFIG_FILE)" mv $CONFIG_FILE $_CONFIG_FILE # Revert back the config file name in case needed. CONFIG_FILE=$_CONFIG_FILE echo "Finished creation of config file ( $_CONFIG_FILE )" } put_mapping_file_copyright_info() { # Start with an emptty file, so don't append, but overwrite here. # Just change the name and add the word pragma, but keep the same # date and version number as in the ident string of this script. grep "ident \"@(#)$PROG" $ABS_PROG | \ sed "s/ ident/pragma ident/g" | \ sed "s/${PROG}/${NEW_NAME}/g" > $MAP_FILE echo "\ # # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License (the "License"). # You may not use this file except in compliance with the License. # # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # When distributing Covered Code, include this CDDL HEADER in each # file and include the License file at usr/src/OPENSOLARIS.LICENSE. # If applicable, add the following below this CDDL HEADER, with the # fields enclosed by brackets "[]" replaced with your own identifying # information: Portions Copyright [yyyy] [name of copyright owner] # # CDDL HEADER END # # # Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. # #------------------------------------------------------------------- #\ " >> $MAP_FILE } # # Filter out all the YP domains in /var/yp # The list of domains is stored in list "VARYP_DMN_LIST" # create_all_var_yp_domain_list() { VARYP_DMN_LIST="" for entry in /var/yp/* do DMN=`basename $entry` if [ -d "/var/yp/$DMN" ] && [ -f "/var/yp/binding/$DMN/ypservers" ] then VARYP_DMN_LIST="$VARYP_DMN_LIST $DMN" fi done # d_echo VARYP_DMN_LIST = "$VARYP_DMN_LIST" [ $DEBUG -eq 1 ] && echo VARYP_DMN_LIST = "$VARYP_DMN_LIST" } # # Ask user which domains would be served by N2L # The list of N2L domains is stored in global array # "N2L_DMN_LIST" and number of domains in N2L_DMN_CNT # create_n2l_domain_list() { # First make a list of all the domains in /var/yp create_all_var_yp_domain_list # Now identify those to be served by N2L let count=0 for DMN in $VARYP_DMN_LIST do get_confirm "Do you want to store maps from ${DMN} domain to LDAP (y/n/h):" \ "n" "selectDomain4N2L_help" if [ $? -eq 1 ]; then N2L_DMN_LIST[count]=$DMN let count="count + 1" fi done N2L_DMN_CNT=$count [ $DEBUG -eq 1 ] && echo N2L_DMN_LIST=${N2L_DMN_LIST[*]} [ $DEBUG -eq 1 ] && echo N2L_DMN_CNT=$N2L_DMN_CNT } # # Make various lists for different types of maps for each N2L domain # and ask user if mapping information and comments need to be generated # for custom maps. # # This function looks big, but since KSH does not support 2-D arrays, or # two level of dereferencing, it forced to have so many lists and arrays. # Lists are better for adding or removing elements, and arrays are better # for accessing with index and in knowing the no. of elements. # create_map_lists() { # Initialize them with no maps. ALL_DMN_ALL_MAPLIST="" ALL_DMN_DEF_MAPLIST="" ALL_DMN_CUST_MAPLIST="" ALL_DMN_AUTO_CUST_MAPLIST="" # Default to don't generate custom mapping info or comment info. CUST_MAP_NEEDED=0 CUST_CMT_NEEDED=0 let count=0 while (( $count < $N2L_DMN_CNT )) do DMN=${N2L_DMN_LIST[count]} MAPDIR=/var/yp/${DMN} # Initialize per domain lists to NULL. ALL_MAPLIST="" DEF_MAPLIST="" CUST_MAPLIST="" AUTO_CUST_MAPLIST="" for dbmfile in $MAPDIR/*.dir do MAP=`basename $dbmfile .dir` # Ignore N2L maps (those with "LDAP_" prefix and ageing.byname) if [[ $MAP != LDAP_* ]] && [[ $MAP != "" ]] && \ [ -f $MAPDIR/${MAP}.pag ] && [[ $MAP != ageing.byname ]] then ALL_MAPLIST="$ALL_MAPLIST $MAP" if present $MAP $DEFAULT_NIS_MAPS then DEF_MAPLIST="$DEF_MAPLIST $MAP" elif [[ $MAP = auto.* ]] then AUTO_CUST_MAPLIST="$AUTO_CUST_MAPLIST $MAP" else # If we reached here, means it is custom map. get_confirm "Do you want the mapping information to be generated for \"$MAP\" map of $DMN domain (y/n/h)?" \ "n" "generate_mapping_info_for_cust_map_help" if [ $? -eq 1 ] then CUST_MAPLIST="$CUST_MAPLIST $MAP" else # If a customer map is not desired, then delete it from # all maplist too. ALL_MAPLIST=$(remove $MAP $ALL_MAPLIST) fi fi fi done # Make ALL_DMN lists as they are very helpful in checking if a map exists. ALL_DMN_ALL_MAPLIST=$(merge_lists $ALL_DMN_ALL_MAPLIST $ALL_MAPLIST) ALL_DMN_DEF_MAPLIST=$(merge_lists $ALL_DMN_DEF_MAPLIST $DEF_MAPLIST) ALL_DMN_CUST_MAPLIST=$(merge_lists $ALL_DMN_CUST_MAPLIST $CUST_MAPLIST) ALL_DMN_AUTO_CUST_MAPLIST=$(merge_lists $ALL_DMN_AUTO_CUST_MAPLIST \ $AUTO_CUST_MAPLIST) # Store per domain lists in arrays. ALL_MAPS[$count]="$ALL_MAPLIST" DEF_MAPS[$count]="$DEF_MAPLIST" CUST_MAPS[$count]="$CUST_MAPLIST" AUTO_CUST_MAPS[$count]="$AUTO_CUST_MAPLIST" [ $DEBUG -eq 1 ] && echo ALL_MAPS[$DMN] = ${ALL_MAPS[$count]} [ $DEBUG -eq 1 ] && echo DEF_MAPS[$DMN] = ${DEF_MAPS[$count]} [ $DEBUG -eq 1 ] && echo CUST_MAPS[$DMN] = ${CUST_MAPS[$count]} [ $DEBUG -eq 1 ] && echo AUTO_CUST_MAPS[$DMN] = ${AUTO_CUST_MAPS[$count]} let count="count + 1" done [ $DEBUG -eq 1 ] && echo ALL_DMN_ALL_MAPLIST = $ALL_DMN_ALL_MAPLIST [ $DEBUG -eq 1 ] && echo ALL_DMN_DEF_MAPLIST = $ALL_DMN_DEF_MAPLIST [ $DEBUG -eq 1 ] && echo ALL_DMN_CUST_MAPLIST = $ALL_DMN_CUST_MAPLIST [ $DEBUG -eq 1 ] && echo ALL_DMN_AUTO_CUST_MAPLIST = $ALL_DMN_AUTO_CUST_MAPLIST # Store all domain lists in array too. set -A ALL_DMN_ALL_MAPS $ALL_DMN_ALL_MAPLIST set -A ALL_DMN_DEF_MAPS $ALL_DMN_DEF_MAPLIST set -A ALL_DMN_CUST_MAPS $ALL_DMN_CUST_MAPLIST set -A ALL_DMN_AUTO_CUST_MAPS $ALL_DMN_AUTO_CUST_MAPLIST # A positive customer map count implies custom mapping information # is required. Set this flag. [ ${#ALL_DMN_CUST_MAPS[*]} -gt 0 ] && CUST_MAP_NEEDED=1 # Give bit of info, and ask if comments need to be placed in mapping file echo " This script can place relevant information regarding custom maps at appropriate places in the mapping file which can be helpful in customizing this file. " get_confirm "Do you want such information to be generated (y/n/h)?" \ "n" "generate_comment_info_for_cust_map_help" [ $? -eq 1 ] && CUST_CMT_NEEDED=1 [ $DEBUG -eq 1 ] && echo CUST_MAP_NEEDED = $CUST_MAP_NEEDED [ $DEBUG -eq 1 ] && echo CUST_CMT_NEEDED = $CUST_CMT_NEEDED } # # Ask user the context for each (N2l) domain # get_nisLDAPdomainContext() { echo " # List domains and contexts " >> $MAP_FILE for DMN in ${N2L_DMN_LIST[*]} do while : do # Convert to domain in dc format for default choice domain_2_dc $DMN get_ans "Enter the naming context for $DMN domain (h=help):"\ "$_DOM_2_DC" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg nisLDAPdomainContext_help ;; * ) break ;; esac done # If a value is specified, set it, and save in mapping file too. if [ "$ANS" != "" ]; then echo "nisLDAPdomainContext $DMN : ${ANS}" >> $MAP_FILE fi [ $DEBUG -eq 1 ] && echo "nisLDAPdomainContext $DMN : ${ANS}" done } # # Ask user the domains for which passwords should be changed # get_nisLDAPyppasswddDomains() { echo " # List domains for which passwords should be changed. If this is not # present then the value returned by 'domainname' will be used. " >> $MAP_FILE for DMN in ${N2L_DMN_LIST[*]} do get_confirm "Enable password changes for ${DMN} domain (y/n/h)? " \ "n" "nisLDAPyppasswddDomains_help" if [ $? -eq 1 ]; then echo "nisLDAPyppasswddDomains $DMN" >> $MAP_FILE fi done echo " # #------------------------------------------------------------------- #\ " >> $MAP_FILE } # # Create NIS databaseId mappings (aliases) # create_nisLDAPdatabaseIdMapping() { echo ' # Associate map names with databaseIds (aliases) # Standard maps nisLDAPdatabaseIdMapping ethers: ethers.byaddr ethers.byname nisLDAPdatabaseIdMapping group: group.bygid group.byname nisLDAPdatabaseIdMapping hosts:[addr="[0-9]*.[0-9]*.[0-9]*.[0-9]*"] \ hosts.byaddr hosts.byname # Special mapping to handle the YP_MULTI cases nisLDAPdatabaseIdMapping multihosts: \ [addr="[0-9]*.[0-9]*.[0-9]*.[0-9]*,*"] \ hosts.byname nisLDAPdatabaseIdMapping networks: networks.byaddr networks.byname nisLDAPdatabaseIdMapping project: project.byname project.byprojid nisLDAPdatabaseIdMapping protocols: protocols.byname protocols.bynumber nisLDAPdatabaseIdMapping services: services.byname services.byservicename # netid.byname is built up from the hosts and passwd files using different # mappings. It thus has two associated nisLDAPdatabaseIdMappings. nisLDAPdatabaseIdMapping netid.host:[number="0"] netid.byname nisLDAPdatabaseIdMapping netid.pass:[number="[1-9]*"] netid.byname # The next two are special databaseIds. They associate maps with databaseIds # but additionally identify which maps contain password and password adjunct # information for yppasswdd. nisLDAPdatabaseIdMapping passwd: passwd.byname passwd.byuid # mail.byaddr needs to select entries of the form x@y or x!y nisLDAPdatabaseIdMapping mail.mapping:[rf_key="*@*", rf_key="*!*"] \ mail.byaddr # publickey.byname # Each entry in publickey map consists of a network user name which # may refer to a host or a user. It also contains a default entry for nobody. # Hence, we need three nisLDAPdatabaseIdmappings to support the three # different types of keys. nisLDAPdatabaseIdMapping keys.host:[rf_key="unix.[a-zA-Z]*@*"] \ publickey.byname nisLDAPdatabaseIdMapping keys.pass:[rf_key="unix.[0-9]*@*"] \ publickey.byname nisLDAPdatabaseIdMapping keys.nobody:[rf_key="nobody"] publickey.byname # Single standard maps. No point aliasing. # mail.aliases # netmasks.byaddr # rpc.bynumber # ypservers # Other maps # ipnodes looks identical to hosts but maps to a different context. nisLDAPdatabaseIdMapping ipnodes:[addr="*:*"] \ ipnodes.byaddr ipnodes.byname # Special mapping to handle the YP_MULTI cases nisLDAPdatabaseIdMapping multiipnodes: \ [addr="*:*,*"] \ ipnodes.byname # Other single maps. No point aliasing # audit_user # auth_attr # exec_attr # prof_attr # user_attr # auto.home # auto.master # bootparams # timezone.byname # printers.conf.byname # passwd.adjunct.byname # group.adjunct.byname ' >> $MAP_FILE [ CUST_CMT_NEEDED -eq 1 ] && \ echo " # If any custom map needs to be aliased, then it should be listed # here in the following format : # nisLDAPdatabaseIdMapping databaseId ":" ["["indexlist"]"] mapname[" "...] " >> $MAP_FILE [ CUST_MAP_NEEDED -eq 1 ] && \ echo "\ # Not aliasing non-default/custom maps as they are assumed to be # simple, single maps.\ " >> $MAP_FILE for MAP in ${ALL_DMN_AUTO_CUST_MAPS[*]} ${ALL_DMN_CUST_MAPS[*]} do echo "# $MAP" >> $MAP_FILE done echo "\ # #------------------------------------------------------------------------------ # " >> $MAP_FILE } # # Finds the domains in which the given map exists in the supplied list. # Sets result in PRESENT_COUNT and PRESENT_IN_DOMAINS. These fields are # set globally, so they can be accessed from any where. # Input : $1 - map, $2 - list name (just name, not the value) # find_domains() { _MAP=$1 _ARRAY=$2 let PRESENT_COUNT=0 PRESENT_IN_DOMAINS="" let count=0 while (( $count < $N2L_DMN_CNT )) do # Quick and dirty way to get around unavailability of 2D array case "$_ARRAY" in ALL_MAPS ) _LIST=${ALL_MAPS[$count]} ;; DEF_MAPS ) _LIST=${DEF_MAPS[$count]} ;; CUST_MAPS ) _LIST=${CUST_MAPS[$count]} ;; AUTO_CUST_MAPS ) _LIST=${AUTO_CUST_MAPS[$count]} ;; * ) echo "Invalid value: \"${_ARRAY}\". \c" ;; esac if present $_MAP $_LIST then let PRESENT_COUNT="$PRESENT_COUNT + 1" PRESENT_IN_DOMAINS="$PRESENT_IN_DOMAINS ${N2L_DMN_LIST[count]}" fi let count="count + 1" done [ $DEBUG -eq 1 ] && echo "PRESENT_COUNT = $PRESENT_COUNT" [ $DEBUG -eq 1 ] && echo "PRESENT_IN_DOMAINS = $PRESENT_IN_DOMAINS" return 0 } # # For a given map, find out which list it belongs to (PRESENT_IN_LIST), # and in how many domains this map shows up (PRESENT_COUNT), and in # which ones (PRESENT_IN_DOMAINS). These fields are set globally, so # they can be accessed from any where. # find_map_presence_details() { _MAP=$1 let PRESENT_COUNT=0 PRESENT_IN_LIST="" PRESENT_IN_DOMAINS="" # If the map does not exist, return right away, else # find which list it belongs to. # If a map exists in def or auto or cust lists, then # it also exists in "all" list. if ! present $_MAP $ALL_DMN_ALL_MAPLIST then return 1 elif present $_MAP $ALL_DMN_DEF_MAPLIST then PRESENT_IN_LIST="DEF_MAPS" elif present $_MAP $ALL_DMN_CUST_MAPLIST then PRESENT_IN_LIST="CUST_MAPS" else # If map exists, and not in previous two lists, # then it has to be here only. PRESENT_IN_LIST="AUTO_CUST_MAPS" fi # Now we know which list the map belongs to. So, we need to # find which are the domains in which this map exists. find_domains $_MAP $PRESENT_IN_LIST # Since the above function sets the values of PRESENT_COUNT and # PRESENT_IN_DOMAINS fields, we don't need to do anything else. [ $DEBUG -eq 1 ] && echo "PRESENT_IN_LIST = $PRESENT_IN_LIST" return 0 } # # Check if the comment char is a single character, return 0 on success. # Input is passed via global variable "COMMENT_CHAR" # valid_comment_char() { COMMENT_CHAR_LENGTH=`echo "${COMMENT_CHAR}" | wc -c` # echo adds new line character, so adjust length appropriately if [ $COMMENT_CHAR_LENGTH -gt 2 ]; then echo " Comment character has to be a blank or single character; try again." return 1 else return 0 fi } # # Read the comment character for a MAP. Append in mapping file if valid. # Input - $1 : MAP name # get_comment_char() { _MAP=$1 while : do get_ans "Specify the comment character for $_MAP :" COMMENT_CHAR=$ANS if valid_comment_char; then break fi done echo "nisLDAPcommentChar $_MAP : '${COMMENT_CHAR}'" >> $MAP_FILE } # # Read a seperate comment character for a MAP for each domain and # update this information in mapping file. # Input - $1 : MAP name, $@ : list of domains # get_comment_char_per_domain() { _MAP=$1 shift _DOMAIN_LIST="$@" for _DMN in $_DOMAIN_LIST do while : do get_ans "Specify the comment character for $_MAP,${_DMN} :" COMMENT_CHAR=$ANS if valid_comment_char; then break fi done echo "nisLDAPcommentChar $_MAP,${_DMN} : '${COMMENT_CHAR}'" >> $MAP_FILE done } # # This function generates custom comment entries. The output is # appended in the mapping file. # get_custom_nisLDAPcommentChar() { # All the auto mounter maps are assumed to have '#' as the default comment # char. But still list the non-default auto map entries here anyway. This # will make it very easy in case these entries need to be changed. for MAP in ${ALL_DMN_AUTO_CUST_MAPS[*]} do echo "nisLDAPcommentChar $MAP : '#'" >> $MAP_FILE done if [ CUST_MAP_NEEDED -eq 1 ]; then get_confirm "Do you wish to specify the comment character for any custom map (y/n/h)?" \ "n" "custom_map_comment_char_help" if [ $? -eq 1 ]; then for MAP in ${ALL_DMN_CUST_MAPS[*]} do get_confirm "Do you wish to specify comment character for \"$MAP\" (y/n/h)?" \ "n" "custom_map_comment_char_help" if [ $? -eq 1 ]; then find_domains $MAP CUST_MAPS if [ $PRESENT_COUNT -gt 1 ]; then echo "Map \"$MAP\" is present in these domains : $PRESENT_IN_DOMAINS" get_confirm "For \"$MAP\", should the same comment character be set for all the domains (y/n/h)?" \ "y" "same_comment_char_help" if [ $? -eq 1 ]; then get_comment_char $MAP else get_comment_char_per_domain $MAP "$PRESENT_IN_DOMAINS" fi else get_comment_char $MAP fi fi done fi fi } # List comment character (if any) for maps create_nisLDAPcommentChar() { echo "\ # Specify the character representing the start of comments. " >> $MAP_FILE [ CUST_CMT_NEEDED -eq 1 ] && echo "\ # The comment character represents the start of the special 'comment' # field in a given NIS map. If this attribute is not present then the # default comment character '#' is used. If a map cannot contain comments # then the NULL ('') comment character should be specified. The format to # specify the comment character is : # nisLDAPcommentChar MAP[,DOMAIN] : 'single_comment_char' " >> $MAP_FILE echo "\ nisLDAPcommentChar group : '' nisLDAPcommentChar passwd : '' nisLDAPcommentChar ageing.byname : '' nisLDAPcommentChar audit_user : '' nisLDAPcommentChar auth_attr : '' nisLDAPcommentChar exec_attr : '' nisLDAPcommentChar user_attr : '' nisLDAPcommentChar bootparams : '' " >> $MAP_FILE # Need to handle passwd.adjunct.byname map for multiple domain. _MAP=passwd.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the syntax in comment form echo "#nisLDAPcommentChar passwd.adjunct.byname: ''" >> $MAP_FILE else # Find the domains in which this map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. echo "nisLDAPcommentChar passwd.adjunct.byname: ''" >> $MAP_FILE else # Not every domain has this map. So, list for the ones which do. for _DMN in $PRESENT_IN_DOMAINS do echo "nisLDAPcommentChar passwd.adjunct.byname,${_DMN}: ''" >> $MAP_FILE done fi fi # passwd.adjunct.byname done # Need to handle group.adjunct.byname map for multiple domain. _MAP=group.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the syntax in comment form echo "#nisLDAPcommentChar group.adjunct.byname: ''" >> $MAP_FILE else # Find the domains in which this map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. echo "nisLDAPcommentChar group.adjunct.byname: ''" >> $MAP_FILE else # Not every domain has this map. So, list for the ones which do. for _DMN in $PRESENT_IN_DOMAINS do echo "nisLDAPcommentChar group.adjunct.byname,${_DMN}: ''" >> $MAP_FILE done fi fi # group.adjunct.byname done echo "" >> $MAP_FILE # Ask user for comment char for custom maps get_custom_nisLDAPcommentChar echo " # #------------------------------------------------------------------------------ # " >> $MAP_FILE } # # Generate secure flag entries # create_secure_flag_entries() { echo "\ # Specify YP_SECURE flags " >> $MAP_FILE [ CUST_CMT_NEEDED -eq 1 ] && echo "\ # If a map is secure, then it needs to be mentioned here # in the following format : # nisLDAPmapFlags mapname : s ">> $MAP_FILE # Need to handle passwd.adjunct.byname map for multiple domain. _MAP=passwd.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the syntax in comment form echo "#nisLDAPmapFlags passwd.adjunct.byname : s" >> $MAP_FILE else # Find the domains in which this map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. echo "nisLDAPmapFlags passwd.adjunct.byname : s" >> $MAP_FILE else # Not every domain has this map. So, list for the ones which do. for _DMN in $PRESENT_IN_DOMAINS do echo "nisLDAPmapFlags passwd.adjunct.byname,${_DMN} : s" >> $MAP_FILE done fi fi # Need to handle group.adjunct.byname map for multiple domain. _MAP=group.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the syntax in comment form echo "#nisLDAPmapFlags group.adjunct.byname : s" >> $MAP_FILE else # Find the domains in which this map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. echo "nisLDAPmapFlags group.adjunct.byname : s" >> $MAP_FILE else # Not every domain has this map. So, list for the ones which do. for _DMN in $PRESENT_IN_DOMAINS do echo "nisLDAPmapFlags group.adjunct.byname,${_DMN} : s" >> $MAP_FILE done fi fi echo "" >> $MAP_FILE STR="any" # Just to make the question look better. while : do get_confirm "Do you wish to set the secure flag for $STR map (y/n/h)?" \ "n" "secure_flag_on_help" if [ $? -eq 0 ]; then return 0 else get_ans "Enter the MAP name :" MAP=$ANS if [[ $MAP = "" ]]; then echo " Error : BLANK map name not allowed; try again" continue fi # Check if the supplied map name exists, and if yes, then # set the PRESENT attributes for further processing find_map_presence_details $MAP case $PRESENT_COUNT in 0 ) echo " Error : $MAP not found in any domain; try again" ;; 1 ) # The map exists in only one domain. echo "nisLDAPmapFlags $MAP : s" >> $MAP_FILE STR="another" # Just to make the question look better. ;; * ) # The map exists in multiple domain. Ask if this flag needs # to be set for all domains, or some specific ones. echo "Map \"$MAP\" is present in these domains : $PRESENT_IN_DOMAINS" get_confirm "For this map, do you wish to set this flag for all the domains (y/n/h)?" \ "y" "secure_flag_all_domains_help" if [ $? -eq 1 ]; then echo "nisLDAPmapFlags $MAP : s" >> $MAP_FILE else for _DMN in $PRESENT_IN_DOMAINS do get_confirm_nodef "Set secure flag for $MAP,${_DMN} (y/n)?" if [ $? -eq 1 ]; then echo "nisLDAPmapFlags $MAP,${_DMN} : s" >> $MAP_FILE fi done fi STR="another" # Just to make the question look better. ;; esac fi done } # # Generate interdomain flag entries # create_interdomain_flag_entries() { INTERDOMAIN_MAP_LIST="ipnodes multiipnodes hosts multihosts services.byservicename" # # Simple function to avoid duplication of code # print_interdomain_entries() { for _MAP in $INTERDOMAIN_MAP_LIST do echo "nisLDAPmapFlags ${_MAP} : b" >> $MAP_FILE done } echo " # Specify YP_INTERDOMAIN flags " >> $MAP_FILE [ CUST_CMT_NEEDED -eq 1 ] && echo "\ # It is used to indicate NIS servers to use the domain name resolver for # host name and address lookups for hosts not found in the maps. # If set, it adds YP_INTERDOMAIN entries in these maps when converting # data from LDAP to YP. It needs to be set in the following format : # nisLDAPmapFlags mapname : b " >> $MAP_FILE # List one set of entries in commented form anyway as it might help # user understand what it means. echo "\ # If \$B is set in /var/yp/Makefile, then this flag should be # set for following maps :\ " >> $MAP_FILE for _MAP in $INTERDOMAIN_MAP_LIST do echo "# nisLDAPmapFlags ${_MAP} : b" >> $MAP_FILE done # Put a blank line for indentation purpose echo >> $MAP_FILE get_confirm "Do you wish to set the \"interdomain\" flag for any domain (y/n/h)?" \ "n" "interdomain_flag_on_help" if [ $? -eq 1 ]; then if [ $N2L_DMN_CNT -gt 1 ]; then get_confirm "Should \"interdomain\" flag be set for all domain (y/n/h)?" \ "y" "interdomain_flag_all_domains_help" if [ $? -eq 1 ]; then print_interdomain_entries else for _DMN in ${N2L_DMN_LIST[*]} do get_confirm_nodef "Set interdomain flag for ${_DMN} (y/n)?" if [ $? -eq 1 ]; then for _MAP in $INTERDOMAIN_MAP_LIST do echo "nisLDAPmapFlags ${_MAP},${_DMN} : b" >> $MAP_FILE done fi done fi else print_interdomain_entries fi fi echo " # #------------------------------------------------------------------------------ # " >> $MAP_FILE return 0 } # # List SECURE and INTERDOMAIN flags # create_nisLDAPmapFlags() { create_secure_flag_entries create_interdomain_flag_entries } # # Print one Map TTL entry in mapping file using supplied TTL. # print_one_map_ttl_entry() { _Map=$1 _iTtlLo=$2 _iTtlHi=$3 _runTtl=$4 echo "\ nisLDAPentryTtl ${_Map}:${_iTtlLo}:${_iTtlHi}:${_runTtl}\ " >> $MAP_FILE return 0 } # # Print all the maps TTL entries of same TTL # values using the supplied TTL triplet. # print_all_same_ttl_entries() { _iTTLlo=$1 _iTTLhi=$2 _runTTL=$3 for _MAP in ${DEF_TTL_MAPLIST} ${ALL_DMN_CUST_MAPS[*]} \ ${ALL_DMN_AUTO_CUST_MAPS[*]} do if [ "$_MAP" != "passwd.adjunct.byname" ] && \ [ "$_MAP" != "group.adjunct.byname" ] then print_one_map_ttl_entry $_MAP $_iTTLlo $_iTTLhi $_runTTL else # adjunct maps might not exist in all the domains. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. print_one_map_ttl_entry $_MAP $_iTTLlo $_iTTLhi $_runTTL else for _DMN_ in $PRESENT_IN_DOMAINS do _STR="${_MAP},${_DMN_}" print_one_map_ttl_entry $_STR $_iTTLlo $_iTTLhi $_runTTL done fi fi done return 0 } # # Read the initialTTLlo. Set the value in global variable. # get_ittl_lo() { get_pos_int "Lower limit for initial TTL (in seconds) (h=help):" \ "$DEF_iTTLlo" "initialTTLlo_help" iTTLlo=${NUM} } # # Read the initialTTLhi. Set the value in global variable. # get_ittl_hi() { get_pos_int "Higher limit for initial TTL (in seconds) (h=help):" \ "$DEF_iTTLhi" "initialTTLhi_help" iTTLhi=${NUM} } # # Read the initialTTLhi. Set the value in global variable. # get_run_ttl() { get_pos_int "Runtime TTL (in seconds) (h=help):" \ "$DEF_runTTL" "runningTTL_help" runTTL=${NUM} } # # Read one TTL triplet. Set the result in global variables. # read_one_ttl_triplet() { # Just call the individual functions for each TTL. get_ittl_lo get_ittl_hi get_run_ttl [ $DEBUG -eq 1 ] && \ echo "TTL = ${iTTLlo}:${iTTLhi}:${runTTL}" return 0 } # # Takes MAP name (with or without domain name) as argument, asks # user for TTL values, and appends the entry in the mapping file. # process_one_map_ttl_value() { _Map_="$1" get_confirm "Retain the default TTL values [$DEF_iTTLlo:$DEF_iTTLhi:$DEF_runTTL] for \"$_Map_\" (y/n/h) ?" \ "y" "default_different_ttl_help" if [ $? -eq 1 ]; then print_one_map_ttl_entry $_Map_ $DEF_iTTLlo $DEF_iTTLhi $DEF_runTTL else echo "Reading TTL values for $_Map_ :" read_one_ttl_triplet print_one_map_ttl_entry $_Map_ $iTTLlo $iTTLhi $runTTL fi return 0 } # # Read only one TTL triplet for each existing MAP without asking # different values for each domain and update the mapping file. # read_all_maps_ttl_values_no_multiple_domain_issue() { # Need to read only one TTL triplet for each existing MAP. for _MAP in ${DEF_TTL_MAPLIST} ${ALL_DMN_CUST_MAPS[*]} \ ${ALL_DMN_AUTO_CUST_MAPS[*]} do if [ "$_MAP" != "passwd.adjunct.byname" ] && \ [ "$_MAP" != "group.adjunct.byname" ] then process_one_map_ttl_value $_MAP else # adjunct maps might not exist in all the domains. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. process_one_map_ttl_value $_MAP else for _DMN_ in $PRESENT_IN_DOMAINS do _STR="${_MAP},${_DMN_}" process_one_map_ttl_value $_STR done fi fi done return 0 } # # Read TTL triplet for each default MAP (in database ID form) while # taking care of multiple domains issue and update the mapping file. # read_default_maps_ttl_values_with_multi_domain_issue() { for _MAP_ in ${DEF_TTL_MAPLIST} do if [ "$_MAP_" != "passwd.adjunct.byname" ] && \ [ "$_MAP_" != "group.adjunct.byname" ] then for _DMN_ in ${N2L_DMN_LIST[*]} do _STR_="${_MAP_},${_DMN_}" # Now process each combination one at a time. process_one_map_ttl_value "$_STR_" done else # List only those domains in which adjunct.byname exists. find_domains $_MAP_ DEF_MAPS for _DMN_ in $PRESENT_IN_DOMAINS do _STR_="${_MAP_},${_DMN_}" process_one_map_ttl_value "$_STR_" done fi done return 0 } # # Read TTL triplet for each existing custom MAP while taking # care of multiple domains issue and update the mapping file. # read_custom_maps_ttl_values_with_multi_domain_issue() { for _MAP_ in ${ALL_DMN_CUST_MAPS[*]} ${ALL_DMN_AUTO_CUST_MAPS[*]} do find_map_presence_details $_MAP_ if [ $PRESENT_COUNT -eq 1 ]; then # This map exists in only one domain. # So, no need to ask for multiple domains. process_one_map_ttl_value $_MAP_ else # Handle multiple domains. echo "Map \"${_MAP_}\" is present in these domains : $PRESENT_IN_DOMAINS" get_confirm "For this map, do you wish to use the same TTL values for all the domains (y/n/h) ?" \ "y" "same_ttl_across_domains_help" if [ $? -eq 1 ]; then # Need to read only one TTL triplet for this MAP. process_one_map_ttl_value $_MAP_ else # Need to ask for each domain for _DMN_ in $PRESENT_IN_DOMAINS do _STR="${_MAP_},${_DMN_}" # Now process each combination one at a time. process_one_map_ttl_value "$_STR" done fi fi done return 0 } # # List the TTL values for various MAPs # create_nisLDAPentryTtl() { echo "\ # Associate TTLs with NIS entries derived from LDAP " >> $MAP_FILE [ CUST_CMT_NEEDED -eq 1 ] && echo "\ # Each map has three TTL values which are specified in seconds. # 1. initialTTLlo (default $DEF_iTTLlo sec) The lower limit for the initial # TTL (in seconds) for data read from disk when the ypserv starts. # # 2. initialTTLhi (default $DEF_iTTLhi sec) The upper limit for initial TTL. # # 3. runningTTL (default $DEF_runTTL sec) The TTL (in seconds) for data # retrieved from LDAP while the ypserv is running. # # If any value is not specified, then default value is used. # The format of TTL entry is : # nisLDAPentryTtl MAP[,DOMAIN]:initialTTLlo:initialTTLhi:runningTTL " >> $MAP_FILE # If no maps are present, just return. [ ${#ALL_DMN_ALL_MAPS[*]} -eq 0 ] && return 0 echo "The default TTL for each map is set to ${DEF_iTTLlo}:${DEF_iTTLhi}:${DEF_runTTL}" get_confirm "Do you wish to change the TTL values for any map (y/n/h) ?" \ "n" "default_ttl_help" if [ $? -eq 0 ]; then # Default values accepted for all the maps. # So, just print all the maps with default TTL values. print_all_same_ttl_entries $DEF_iTTLlo $DEF_iTTLhi $DEF_runTTL else echo "You would be allowed to enter the new TTL values." get_confirm "Do you wish to use the same TTL values for all the maps (y/n/h) ?" \ "y" "non_default_same_ttl_help" if [ $? -eq 1 ]; then # Need to read only one TTL triplet. # Print all the maps with new TTL triplet. # read one ttl triplet echo "Enter the new TTL values :" read_one_ttl_triplet print_all_same_ttl_entries $iTTLlo $iTTLhi $runTTL else if [ $N2L_DMN_CNT -eq 1 ]; then # TTL values are different now. But we haev only one domain. # So, no need to worry about multiple domains. Need to read # only one TTL triplet for each existing MAP. read_all_maps_ttl_values_no_multiple_domain_issue else # TTL values are different now. And we have multiple domains # too. Check if MAPS are going to have same TTL across domains. # This is just to avoid asking too many TTL triplet inputs echo "You would be allowed to enter different TTL values for each map." get_confirm "For a given map, do you wish to use the same TTL values for all the domains (y/n/h) ?" \ "y" "non_default_different_ttl_help" if [ $? -eq 1 ]; then # Need to read only one TTL triplet for each existing MAP. read_all_maps_ttl_values_no_multiple_domain_issue else # We have hit the worst case scenario. TTLs could be # different per map and per domain. read_default_maps_ttl_values_with_multi_domain_issue read_custom_maps_ttl_values_with_multi_domain_issue fi fi fi fi echo " # #------------------------------------------------------------------------------ # " >> $MAP_FILE return 0 } # # The custom maps for which we do not have enough # information to be able to generate specific entries, # we just log the message that the user needs to take # care of those entries manually. # ask_user_to_update_the_custom_map_entries_too() { if [ ${#ALL_DMN_CUST_MAPS[*]} -gt 0 ]; then echo " # Similar entries need to be created # for following custom maps too :\ " >> $MAP_FILE for _MAP in ${ALL_DMN_CUST_MAPS[*]} do echo "# $_MAP" >> $MAP_FILE done fi } put_default_nisLDAPnameFields() { echo ' # Associate names with fields in the maps. Must be same for all domains. nisLDAPnameFields audit_user: \ ("%s:%s:%s", name, alwaysAuditFlags, neverAuditFlags) nisLDAPnameFields auto.home: \ ("%s",value) nisLDAPnameFields auto.master: \ ("%s",value) nisLDAPnameFields auth_attr: \ ("%s:%s:%s:%s:%s:%s", \ name, res1, res2, short_desc, long_desc, attrs ) nisLDAPnameFields bootparams: \ ("%s", params) nisLDAPnameFields ethers: \ ("%s %s", addr, name) nisLDAPnameFields exec_attr: \ ("%s:%s:%s:%s:%s:%s:%s", \ name, policy, type, res1, res2, id, attrs) nisLDAPnameFields group: \ ("%s:%s:%s:%s", name, passwd, gid, users) ' >> $MAP_FILE # Need to handle group.adjunct.byname map for multiple domain. _MAP=group.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the syntax in comment form echo '#nisLDAPnameFields group.adjunct.byname: \ # ("%s:%s", name, passwd) ' >> $MAP_FILE else # Find the domains in which this map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. echo 'nisLDAPnameFields group.adjunct.byname: \ ("%s:%s", name, passwd) ' >> $MAP_FILE else # Not every domain has this map. So, list for the ones which do. for _DMN in $PRESENT_IN_DOMAINS do echo "nisLDAPnameFields group.adjunct.byname,${_DMN}: \\ (\"%s:%s\", name, passwd) " >> $MAP_FILE done fi fi echo 'nisLDAPnameFields keys.host: \ ("%s:%s", publicKey ,secretKey) nisLDAPnameFields keys.pass: \ ("%s:%s", publicKey ,secretKey) nisLDAPnameFields keys.nobody: \ ("%s:%s", publicKey ,secretKey) nisLDAPnameFields hosts: \ ("%a %s %s", addr, canonicalName, aliases) nisLDAPnameFields multihosts: \ ("%a %s %s", addr, canonicalName, aliases) nisLDAPnameFields ipnodes: \ ("%a %s %s", addr, canonicalName, aliases) nisLDAPnameFields multiipnodes: \ ("%a %s %s", addr, canonicalName, aliases) nisLDAPnameFields mail.aliases: \ ("%s", addresses) nisLDAPnameFields mail.mapping: \ ("%s", address) # memberTriples is split into sub-fields by a latter nisLDAPsplitField # attribute. nisLDAPnameFields netgroup: \ ("%s", memberTriples) nisLDAPnameFields netid.host: \ ("%s:%s", number, data) nisLDAPnameFields netid.pass: \ ("%s:%s", number, data) nisLDAPnameFields netmasks.byaddr: \ ("%a", mask) nisLDAPnameFields networks: \ ("%s %s %s", name, number, aliases) nisLDAPnameFields project: \ ("%s:%s:%s:%s:%s:%s", \ name, projID, comment, users, groups, attrs) nisLDAPnameFields protocols: \ ("%s %s %s", name, number, aliases) nisLDAPnameFields rpc.bynumber: \ ("%s %s %s", name, number, aliases) nisLDAPnameFields passwd: \ ("%s:%s:%s:%s:%s:%s:%s", \ name, passwd, uid, gid, gecos, home, shell) # It is not obvious what the fields in passwd.adjunct are for. They are not # the same as the shadow map. The following is based on information in:- # # lib/libbc/inc/include/pwdadj.h. # # This file implies that these are documented in getpwaent(3) but this man page # does not seem to exist. # # It is believed that 'min','max' and 'def' labels were reserved fields in # SunOS 4.x and are now unused. 'always' and 'never' audit information is # now contained in audit_user(5) so is now unused. # ' >> $MAP_FILE # Need to handle passwd.adjunct.byname map for multiple domain. _MAP=passwd.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the syntax in comment form echo '#nisLDAPnameFields passwd.adjunct.byname: \ # ("%s:%s:%s:%s:%s:%s:%s", \ # name, passwd, min, max, def, always, \ # never) ' >> $MAP_FILE else # Find the domains in which this map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. echo 'nisLDAPnameFields passwd.adjunct.byname: \ ("%s:%s:%s:%s:%s:%s:%s", \ name, passwd, min, max, def, always, \ never) ' >> $MAP_FILE else # Not every domain has this map. So, list for the ones which do. for _DMN in $PRESENT_IN_DOMAINS do echo "nisLDAPnameFields passwd.adjunct.byname,${_DMN}: \\ (\"%s:%s:%s:%s:%s:%s:%s\", \\ name, passwd, min, max, def, always, \\ never) " >> $MAP_FILE done fi fi echo ' nisLDAPnameFields printers.conf.byname: \ ("%s:%s", names, values) nisLDAPnameFields prof_attr: \ ("%s:%s:%s:%s:%s", \ name, res1, res2, desc, attrs) nisLDAPnameFields services: \ ("%s %s/%s %s", name, port, protocol, aliases) # This map is never created but yppasswd uses the mapping to extract password # ageing information from the DIT. The password itself is not required by this # mechanism so is not included in the ageing mapping. nisLDAPnameFields ageing.byname: \ ("%s:%s:%s:%s:%s:%s:%s:%s", \ name, lastchg, min, max, warn, inactive, \ expire, flag) nisLDAPnameFields timezone.byname: \ ("%s %s", zoneName, hostName) nisLDAPnameFields user_attr: \ ("%s:%s:%s:%s:%s", user, qualifier, res1, res2, attrs) ' >> $MAP_FILE } # # List namefields for non-default auto maps and custom maps. # put_auto_and_custom_map_nisLDAPnameFields() { for _MAP in ${ALL_DMN_AUTO_CUST_MAPS[*]} ${ALL_DMN_CUST_MAPS[*]} do echo "\ nisLDAPnameFields ${_MAP}: \\ (\"%s\",value) " >> $MAP_FILE done } create_nisLDAPnameFields() { # Put format information of "nisLDAPnameFields" [ CUST_CMT_NEEDED -eq 1 ] && echo ' # "nisLDAPnameFields" specifies the content of entries in a NIS map # and how they should be broken into named fields. It is required as, # unlike NIS+, NIS maps do not store information in named fields. # # Following is the syntax for nisLDAPnameFields : # # "nisLDAPnameFields" mapName ":" "(" matchspec "," fieldNames ")" # fieldName = nameOrArrayName[","...] # nameOrArrayName = Name of field or 'array' of repeated fields. # matchspec = \" formatString \" ' >> $MAP_FILE # List the default nameField values put_default_nisLDAPnameFields # List the underlying assumption echo "\ # With the assumption that all the custom maps are simple, single # map (single key-value pair type), below is the nisLDAPnameFields # information for all the custom and non-default auto.* maps. If # this assumption is not valid, then refer to the NISLDAPmapping # man page for information on how to customize this section. " >> $MAP_FILE # List namefields for non-default auto maps and custom maps. put_auto_and_custom_map_nisLDAPnameFields echo " # #------------------------------------------------------------------------------ # " >> $MAP_FILE return 0 } # # List repeated field seperators # create_nisLDAPrepeatedFieldSeparators() { [ CUST_CMT_NEEDED -eq 1 ] && echo " # nisLDAPrepeatedFieldSeparators : It is a character which separates # the repeatable instnaces of splitable fields. It's format is : # # nisLDAPrepeatedFieldSeparators fieldName \"sepChar[...]\" # sepChar = A separator character. # Default value is space or tab. " >> $MAP_FILE echo "\ #nisLDAPrepeatedFieldSeparators memberTriples: \" \t\" " >> $MAP_FILE } # # List split fields # create_nisLDAPsplitField() { # List the default split fields [ CUST_CMT_NEEDED -eq 1 ] && echo ' # nisLDAPsplitFields : It defines how a field, or list of fields, # named by nisLDAPnameFields is split into sub fields. The original # field is compared with each line of this attribute until one matches. # When a match is found named sub-fields are generated. In latter # operations sub-field names can be used in the same way as other # field names. The format of nisLDAPsplitFields is : # # "nisLDAPsplitFields" fieldName ":" splitSpec[","...] # splitSpec = "(" matchspec "," subFieldNames ")" # fieldName = Name of a field from nisLDAPnameFields # subFieldNames = subFieldname[","...] # matchspec = \" formatString \" ' >> $MAP_FILE echo ' nisLDAPsplitField memberTriples: \ ("(%s,%s,%s)", host, user, domain), \ ("%s", group) ' >> $MAP_FILE } # # List split fields and repeated field separators. # create_split_field_and_repeatedfield_seperators() { echo "\ # Specify how to break fields up into sub fields. " >> $MAP_FILE create_nisLDAPrepeatedFieldSeparators create_nisLDAPsplitField echo " # #------------------------------------------------------------------------------ # " >> $MAP_FILE } list_default_nisLDAPobjectDN() { echo ' # Associate maps with RDNs and object classes. Base DN comes from the # nisLDAPdomainContext. # # As supplied this file gives only the most derived objectClass for each map. # For some servers it may be necessary to add "objectClass=" statements for # all the superclasses. This should be done here. nisLDAPobjectDN auto.home: \ automountmapname=auto_home,?one? \ objectClass=automount: nisLDAPobjectDN auto.master: \ automountmapname=auto_master,?one? \ objectClass=automount: nisLDAPobjectDN auth_attr: \ ou=SolarisAuthAttr,?one? \ objectClass=SolarisAuthAttr: nisLDAPobjectDN bootparams: \ ou=ethers,?one? \ objectClass=bootableDevice, \ bootParameter=*:\ ou=ethers,?one? \ objectClass=device, \ objectClass=bootableDevice nisLDAPobjectDN exec_attr:\ ou=SolarisProfAttr,?one?objectClass=SolarisExecAttr,\ SolarisKernelSecurityPolicy=*:\ ou=SolarisProfAttr,?one?objectClass=SolarisExecAttr,\ objectClass=SolarisProfAttr,\ objectClass=top nisLDAPobjectDN ethers: \ ou=ethers,?one? \ objectClass=ieee802Device, \ macAddress=*:\ ou=ethers,?one? \ objectClass=device, \ objectClass=ieee802Device nisLDAPobjectDN group: \ ou=group,?one? \ objectClass=posixGroup: ' >> $MAP_FILE # Need to handle group.adjunct.byname map for multiple domain. _MAP=group.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the syntax in comment form echo '#nisLDAPobjectDN group.adjunct.byname: \ # ou=group,?one? \ # objectClass=posixGroup: ' >> $MAP_FILE else # Find the domains in which this map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. echo 'nisLDAPobjectDN group.adjunct.byname: \ ou=group,?one? \ objectClass=posixGroup: ' >> $MAP_FILE else # Not every domain has this map. So, list for the ones which do. for _DMN in $PRESENT_IN_DOMAINS do echo "nisLDAPobjectDN group.adjunct.byname,${_DMN}: \\ ou=group,?one? \\ objectClass=posixGroup: " >> $MAP_FILE done fi fi echo 'nisLDAPobjectDN hosts: \ ou=hosts,?one? \ objectClass=ipHost:\ ou=hosts,?one? \ objectClass=device, \ objectClass=ipHost nisLDAPobjectDN multihosts: \ ou=hosts,?one? \ objectClass=ipHost, \ ipHostNumber=*.* nisLDAPobjectDN ipnodes: \ ou=hosts,?one? \ objectClass=ipHost:\ ou=hosts,?one? \ objectClass=device, \ objectClass=ipHost nisLDAPobjectDN multiipnodes: \ ou=hosts,?one? \ objectClass=ipHost, \ ipHostNumber=*\:* nisLDAPobjectDN mail.aliases: \ ou=aliases,?one? \ objectClass=mailGroup: nisLDAPobjectDN mail.mapping: \ ou=aliases,?one? \ objectClass=mailGroup nisLDAPobjectDN netgroup: \ ou=netgroup,?one? \ objectClass=nisNetgroup: nisLDAPobjectDN networks: \ ou=networks,?one? \ objectClass=ipNetwork, \ cn=*: # Must come after networks (or equivalent) that creates ipNetworks nisLDAPobjectDN netmasks.byaddr: \ ou=networks,?one? \ objectClass=ipNetwork, \ ipNetMaskNumber=*: nisLDAPobjectDN passwd: \ ou=people,?one? \ objectClass=posixAccount:\ ou=people,?one? \ objectClass=account, \ objectClass=shadowAccount, \ objectClass=posixAccount ' >> $MAP_FILE # Need to handle passwd.adjunct.byname map for multiple domain. _MAP=passwd.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the syntax in comment form echo '#nisLDAPobjectDN passwd.adjunct.byname: \ # ou=people,?one? \ # objectClass=posixAccount:\ # ou=people,?one? \ # objectClass=account, \ # objectClass=shadowAccount, \ # objectClass=posixAccount ' >> $MAP_FILE else # Find the domains in which this map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # Don't put domain info as the map is present in all of them. echo 'nisLDAPobjectDN passwd.adjunct.byname: \ ou=people,?one? \ objectClass=posixAccount:\ ou=people,?one? \ objectClass=account, \ objectClass=shadowAccount, \ objectClass=posixAccount ' >> $MAP_FILE else # Not every domain has this map. So, list for the ones which do. for _DMN in $PRESENT_IN_DOMAINS do echo "nisLDAPobjectDN passwd.adjunct.byname,${_DMN}: \\ ou=people,?one? \\ objectClass=posixAccount:\\ ou=people,?one? \\ objectClass=account, \\ objectClass=shadowAccount, \\ objectClass=posixAccount " >> $MAP_FILE done fi fi echo '# Must follow passwd nisLDAPobjectDN netid.pass: \ ou=people,?one? \ objectClass=posixAccount # Must follow hosts nisLDAPobjectDN netid.host: \ ou=hosts,?one? \ objectClass=ipHost nisLDAPobjectDN printers.conf.byname: \ ou=printers,?one? \ objectClass=printerService:\ ou=printers,?one? \ objectClass=sunPrinter, \ objectClass=printerService, \ objectClass=printerLPR, \ objectClass=printerAbstract nisLDAPobjectDN prof_attr:\ ou=SolarisProfAttr,?one?objectClass=SolarisProfAttr,\ SolarisAttrLongDesc=*:\ ou=SolarisProfAttr,?one?objectClass=SolarisProfAttr,\ objectClass=SolarisExecAttr,\ objectClass=top nisLDAPobjectDN project: \ ou=project,?one? \ objectClass=SolarisProject: nisLDAPobjectDN protocols: \ ou=protocols,?one? \ objectClass=ipProtocol: nisLDAPobjectDN rpc.bynumber: \ ou=rpc,?one? \ objectClass=oncRpc: nisLDAPobjectDN services.byname: \ ou=services,?one? \ objectClass=ipService: # Because services.byservicename contains keys of form both 'name' # and 'name/protocol' we generate the DIT just from services.byname. # Hence, write-disabled for services.byservicename nisLDAPobjectDN services.byservicename: \ ou=services,?one? \ objectClass=ipService # This map is never created but yppasswd uses the mapping to extract password # aging information from the DIT. nisLDAPobjectDN ageing.byname: \ ou=people,?one? \ objectClass=shadowAccount: # Using nisplusTimeZoneData objectClass for compatibility with nis+2ldap nisLDAPobjectDN timezone.byname: \ ou=Timezone,?one? \ objectClass=nisplusTimeZoneData: nisLDAPobjectDN user_attr: \ ou=people,?one? \ objectClass=SolarisUserAttr: # Must come after passwd (or equivalent) that creates posixAccounts nisLDAPobjectDN audit_user: \ ou=people,?one? \ objectClass=SolarisAuditUser: # Must come after hosts + passwd. nisLDAPobjectDN keys.host: \ ou=hosts,?one? \ objectClass=NisKeyObject: nisLDAPobjectDN keys.pass: \ ou=people,?one? \ objectClass=NisKeyObject: nisLDAPobjectDN keys.nobody: \ ou=people,?one? \ objectClass=NisKeyObject:\ ou=people,?one? \ objectClass=account, \ objectClass=NisKeyObject nisLDAPobjectDN ypservers: \ ou=ypservers,?one? \ objectClass=device: ' >> $MAP_FILE } # List all the non-default auto.* and custom maps. list_auto_custom_nisLDAPobjectDN() { # auto.* entries are easy. if [ ${#ALL_DMN_AUTO_CUST_MAPS[*]} -gt 0 ]; then echo "# Non-default custom auto maps (auto.*)\n" >> $MAP_FILE for _MAP in ${ALL_DMN_AUTO_CUST_MAPS[*]} do # We need to find one container for each auto.* map. # Assume that each auto.* maps's container is auto_*. _MAP_UNDERSCORE=`echo $_MAP | sed "s/auto\./auto_/"` echo "\ nisLDAPobjectDN ${_MAP}: \\ automountmapname=${_MAP_UNDERSCORE},?one? \\ objectClass=automount: " >> $MAP_FILE done fi # Since we do not have enough information to generate # entries for other custom maps, best we can do is to # log this map names and ask user to take care of them. ask_user_to_update_the_custom_map_entries_too } # # List association of maps with RDNs and object classes. # create_nisLDAPobjectDN() { [ CUST_CMT_NEEDED -eq 1 ] && echo ' # nisLDAPobjectDN : It specifies the connection between group of NIS # maps and the LDAP directory. This attribute also defines the 'order' # of the NIS maps. When NIS maps are bulk copied to or from the DIT # they are processed in the same order as related nisLDAPobjectDN # attributes appear in /var/yp/NISLDAPmapping. # The format of "nisLDAPobjectDN" is : # # mapName[" "...] ":" objectDN *( ";" objectDN ) # # where: # # objectDN = readObjectSpec [":"[writeObjectSpec]] # readObjectSpec = [baseAndScope [filterAttrValList]] # writeObjectSpec = [baseAndScope [attrValList]] # baseAndScope = [baseDN] ["?" [scope]] # filterAttrValList = ["?" [filter | attrValList]]] # scope = "base" | "one" | "sub" # attrValList = attribute "=" value # *("," attribute "=" value) ' >> $MAP_FILE # List all the default entries anyway. list_default_nisLDAPobjectDN # List all the non-default auto.* and custom maps. list_auto_custom_nisLDAPobjectDN } # # List all the default nisLDAPattributeFromField entries # list_default_nisLDAPattributeFromField() { echo ' # Describe how named fields are mapped to DIT entries. # audit_user nisLDAPattributeFromField audit_user: \ dn=("uid=%s,", rf_key ), \ SolarisAuditAlways=alwaysAuditFlags, \ SolarisAuditNever=neverAuditFlags # auto.home nisLDAPattributeFromField auto.home: \ dn=("automountKey=%s,", rf_key ), \ automountKey=rf_key, \ automountInformation=value # auto.master nisLDAPattributeFromField auto.master: \ dn=("automountKey=%s,", rf_key ), \ automountKey=rf_key, \ automountInformation=value # auth_attr nisLDAPattributeFromField auth_attr: \ dn=("cn=%s,", rf_key ), \ cn=name, \ SolarisAttrReserved1=res1, \ SolarisAttrReserved2=res2, \ SolarisAttrShortDesc=short_desc, \ SolarisAttrLongDesc=long_desc, \ SolarisAttrKeyValue=attrs # exec_attr. Because of the messy NIS keys special handling is required here nisLDAPattributeFromField exec_attr: \ dn=("cn=%s+SolarisKernelSecurityPolicy=%s\ +SolarisProfileType=%s+SolarisProfileID=%s,", \ name, policy,type,id), \ ("%s:*", cn)=rf_key, \ ("*:%s:*", SolarisKernelSecurityPolicy)=rf_key, \ ("*:*:%s", SolarisProfileId)=rf_key, \ solarisProfileType=type, \ solarisAttrReserved1=res1, \ SolarisAttrReserved2=res2, \ solarisAttrKeyValue=attrs # ethers nisLDAPattributeFromField ethers.byname: \ dn=("cn=%s,", rf_key ), \ macAddress=addr nisLDAPattributeFromField ethers.byaddr: \ dn=("cn=%s,", name ), \ macAddress=rf_key nisLDAPattributeFromField ethers: \ cn=name, \ description=rf_comment # bootparams. Must be done after ethers nisLDAPattributeFromField bootparams: \ dn=("cn=%s,", rf_key ), \ cn=rf_key, \ (bootParameter)=(params, " ") ' >> $MAP_FILE # group syntax is different when group.adjunct map is present. # So, need to handle the various possibilities _MAP=group.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the group.adjunct syntax in comment form echo '# group nisLDAPattributeFromField group.byname: \ dn=("cn=%s,", rf_key ), \ gidNumber=gid nisLDAPattributeFromField group.bygid: \ dn=("cn=%s,", name ), \ gidNumber=rf_key nisLDAPattributeFromField group: \ cn=name, \ userPassword=("{crypt}%s",passwd), \ (memberUid)=(users, ",") # # If you are using group.adjunct, comment the group section above # and uncomment the following group and group.adjunct sections # # group #nisLDAPattributeFromField group.byname: \ # dn=("cn=%s,", rf_key ), \ # gidNumber=gid #nisLDAPattributeFromField group.bygid: \ # dn=("cn=%s,", name ), \ # gidNumber=rf_key #nisLDAPattributeFromField group: \ # cn=name, \ # (memberUid)=(users, ",") # group.adjunct #nisLDAPattributeFromField group.adjunct.byname: \ # dn=("cn=%s,", rf_key ), \ # cn=name, \ # userPassword=("{crypt}%s",passwd) ' >> $MAP_FILE else # Find the domains in which group.adjunct map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # All the domains have group.adjunct map. echo '# group #nisLDAPattributeFromField group.byname: \ # dn=("cn=%s,", rf_key ), \ # gidNumber=gid #nisLDAPattributeFromField group.bygid: \ # dn=("cn=%s,", name ), \ # gidNumber=rf_key #nisLDAPattributeFromField group: \ # cn=name, \ # userPassword=("{crypt}%s",passwd), \ # (memberUid)=(users, ",") # If you are not using group.adjunct, uncomment the group section above # and comment the following group and group.adjunct sections # # group nisLDAPattributeFromField group.byname: \ dn=("cn=%s,", rf_key ), \ gidNumber=gid nisLDAPattributeFromField group.bygid: \ dn=("cn=%s,", name ), \ gidNumber=rf_key nisLDAPattributeFromField group: \ cn=name, \ (memberUid)=(users, ",") # group.adjunct nisLDAPattributeFromField group.adjunct.byname: \ dn=("cn=%s,", rf_key ), \ cn=name, \ userPassword=("{crypt}%s",passwd) ' >> $MAP_FILE else # Not every domain has group.adjunct map. # First put the password syntax with domain name for domains # in which group.adjunct exists. echo "# group" >> $MAP_FILE for _DMN in $PRESENT_IN_DOMAINS do echo "\ # domain-specific group nisLDAPattributeFromField group.byname,${_DMN}: \\ dn=(\"cn=%s,\", rf_key ), \\ gidNumber=gid nisLDAPattributeFromField group.bygid,${_DMN}: \\ dn=(\"cn=%s,\", name ), \\ gidNumber=rf_key nisLDAPattributeFromField group,${_DMN}: \\ cn=name, \\ (memberUid)=(users, \",\") " >> $MAP_FILE done # Now put the other group syntax. We do not need to # append the domain name here. echo ' nisLDAPattributeFromField group.byname: \ dn=("cn=%s,", rf_key ), \ gidNumber=gid nisLDAPattributeFromField group.bygid: \ dn=("cn=%s,", name ), \ gidNumber=rf_key nisLDAPattributeFromField group: \ cn=name, \ userPassword=("{crypt}%s",passwd), \ (memberUid)=(users, ",") ' >> $MAP_FILE # Now we need to put the group.adjunct syntax for domains # in which this map exists. echo "# group.adjunct" >> $MAP_FILE for _DMN in $PRESENT_IN_DOMAINS do echo "\ nisLDAPattributeFromField group.adjunct.byname,${_DMN}: \\ dn=(\"cn=%s,\", rf_key ), \\ cn=name, \\ userPassword=(\"{crypt}%s\",passwd) " >> $MAP_FILE done fi fi echo ' # hosts # Cannot forward map hosts.byname key as the YP_MULTI entries will not work. nisLDAPattributeFromField hosts.byname: \ cn=rf_searchkey nisLDAPattributeFromField hosts.byaddr: \ ipHostNumber=rf_searchipkey nisLDAPattributeFromField hosts: \ ipHostNumber=addr, \ dn=("cn=%s+ipHostNumber=%s,", canonicalName, addr), \ cn=canonicalName, \ (cn)=(aliases, " "), \ description=rf_comment nisLDAPattributeFromField multihosts: \ ("YP_MULTI_%s", cn)=rf_searchkey # ipnodes # Cannot forward map ipnodes.byname key as the YP_MULTI entries will not work. nisLDAPattributeFromField ipnodes.byname: \ cn=rf_searchkey nisLDAPattributeFromField ipnodes.byaddr: \ ipHostNumber=rf_searchipkey nisLDAPattributeFromField ipnodes: \ ipHostNumber=addr, \ dn=("cn=%s+ipHostNumber=%s,", canonicalName, addr), \ cn=canonicalName, \ (cn)=(aliases, " "), \ description=rf_comment nisLDAPattributeFromField multiipnodes: \ ("YP_MULTI_%s", cn)=rf_searchkey #mail.aliases nisLDAPattributeFromField mail.aliases: \ dn=("mail=%s,", rf_key), \ mail=rf_key, \ (mgrprfc822mailmember)=(addresses, ",") #mail.mapping #Commented out because all NIS->LDAP mappings are done by mail.aliases #nisLDAPattributeFromField mail.mapping: \ # dn=("mail=%s,", address), \ # mail=address, \ # mgrprfc822mailmember=rf_key nisLDAPattributeFromField mail.mapping: \ mgrprfc822mailmember=rf_searchkey # netgroup. # # Only need to create DIT entries for netgroup. This contains a superset of # the information in netgroup.byhost and netgroup.byuser nisLDAPattributeFromField netgroup: \ dn=("cn=%s,", rf_key ), \ (memberNisNetgroup)=group, \ (nisNetgroupTriple)= \ ("(%s,%s,%s)", host, user, domain), \ cn=rf_key, \ description=rf_comment # netid.pass # # Commented out because, unless remote domains (and thus /etc/netid) is # supported, all NIS->LDAP mappings are set up from passwd. #nisLDAPattributeFromField netid.pass: \ # ("unix.%s@*", uidNumber)=rf_key, \ # (gidNumber)=("%s", (data), " "), \ # description=rf_comment nisLDAPattributeFromField netid.pass: \ ("unix.%s@*", uidNumber)=rf_searchkey # netid.host # # Commented out because, unless remote domains (and thus /etc/netid) is # supported, all NIS->LDAP mappings are set up from hosts. #nisLDAPattributeFromField netid.host: \ # dn=("cn=%s+ipHostNumber=%s,", data, \ # ldap:ipHostNumber:?one?("cn=%s", data)), \ # ipHostNumber=ldap:ipHostNumber:?one?("cn=%s", data), \ # ("unix.%s@*", cn)=rf_key, \ # description=rf_comment nisLDAPattributeFromField netid.host: \ ("unix.%s@*", cn)=rf_searchkey # netmasks.byaddr nisLDAPattributeFromField netmasks.byaddr: \ dn=("ipNetworkNumber=%s,", rf_ipkey ), \ ipNetworkNumber=rf_ipkey, \ ipNetmaskNumber=mask, \ description=rf_comment # networks. nisLDAPattributeFromField networks.byname: \ dn=("ipNetworkNumber=%s,", number ), \ cn=name, \ cn=rf_key nisLDAPattributeFromField networks.byaddr: \ dn=("ipNetworkNumber=%s,", rf_key ), \ cn=name nisLDAPattributeFromField networks: \ (cn)=(aliases, " "), \ ipNetworkNumber=number, \ description=rf_comment ' >> $MAP_FILE # passwd syntax is different when passwd.adjunct map is present. # So, need to handle the various possibilities _MAP=passwd.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the passwd.adjunct syntax in comment form echo '# passwd nisLDAPattributeFromField passwd.byname: \ dn=("uid=%s,", rf_key ), \ uid=rf_key, \ uidNumber=uid nisLDAPattributeFromField passwd.byuid: \ dn=("uid=%s,", name ), \ uidNumber=rf_key, \ uid=name nisLDAPattributeFromField passwd: \ cn=name, \ userPassword=("{crypt}%s",passwd), \ gidNumber=gid, \ gecos=gecos, \ homeDirectory=home, \ loginShell=shell # # If you are using passwd.adjunct, comment the passwd section above # and uncomment the following passwd and passwd.adjunct sections # # passwd #nisLDAPattributeFromField passwd.byname: \ # dn=("uid=%s,", rf_key ), \ # uid=rf_key, \ # uidNumber=uid #nisLDAPattributeFromField passwd.byuid: \ # dn=("uid=%s,", name ), \ # uidNumber=rf_key, \ # uid=name #nisLDAPattributeFromField passwd: \ # cn=name, \ # gidNumber=gid, \ # gecos=gecos, \ # homeDirectory=home, \ # loginShell=shell # passwd.adjunct #nisLDAPattributeFromField passwd.adjunct.byname: \ # dn=("uid=%s,", rf_key ), \ # uid=name, \ # userPassword=("{crypt}%s",passwd) ' >> $MAP_FILE else # Find the domains in which passwd.adjunct map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # All the domains have passwd.adjunct map. So, put the right # passwd syntax and comment-in the passwd.adjunct syntax. echo '# passwd #nisLDAPattributeFromField passwd.byname: \ # dn=("uid=%s,", rf_key ), \ # uid=rf_key, \ # uidNumber=uid #nisLDAPattributeFromField passwd.byuid: \ # dn=("uid=%s,", name ), \ # uidNumber=rf_key, \ # uid=name #nisLDAPattributeFromField passwd: \ # cn=name, \ # userPassword=("{crypt}%s",passwd), \ # gidNumber=gid, \ # gecos=gecos, \ # homeDirectory=home, \ # loginShell=shell # If you are not using passwd.adjunct, uncomment the passwd section above # and comment the following passwd and passwd.adjunct sections # # passwd nisLDAPattributeFromField passwd.byname: \ dn=("uid=%s,", rf_key ), \ uid=rf_key, \ uidNumber=uid nisLDAPattributeFromField passwd.byuid: \ dn=("uid=%s,", name ), \ uidNumber=rf_key, \ uid=name nisLDAPattributeFromField passwd: \ cn=name, \ gidNumber=gid, \ gecos=gecos, \ homeDirectory=home, \ loginShell=shell # passwd.adjunct nisLDAPattributeFromField passwd.adjunct.byname: \ dn=("uid=%s,", rf_key ), \ uid=name, \ userPassword=("{crypt}%s",passwd) ' >> $MAP_FILE else # Not every domain has passwd.adjunct map. # First put the password syntax with domain name for domains # in which passwd.adjunct exists. echo "# passwd" >> $MAP_FILE for _DMN in $PRESENT_IN_DOMAINS do echo "\ nisLDAPattributeFromField passwd.byname,${_DMN}: \\ dn=(\"uid=%s,\", rf_key ), \\ uid=rf_key, \\ uidNumber=uid nisLDAPattributeFromField passwd.byuid,${_DMN}: \\ dn=(\"uid=%s,\", name ), \\ uidNumber=rf_key, \\ uid=name nisLDAPattributeFromField passwd,${_DMN}: \\ cn=name, \\ gidNumber=gid, \\ gecos=gecos, \\ homeDirectory=home, \\ loginShell=shell " >> $MAP_FILE done # Now put the other passwd syntax. We do not need to # append the domain name here. echo ' nisLDAPattributeFromField passwd.byname: \ dn=("uid=%s,", rf_key ), \ uid=rf_key, \ uidNumber=uid nisLDAPattributeFromField passwd.byuid: \ dn=("uid=%s,", name ), \ uidNumber=rf_key, \ uid=name nisLDAPattributeFromField passwd: \ cn=name, \ userPassword=("{crypt}%s",passwd), \ gidNumber=gid, \ gecos=gecos, \ homeDirectory=home, \ loginShell=shell ' >> $MAP_FILE # Now we need to put the passwd.adjunct syntax for domains # in which this map exists. echo "# passwd.adjunct" >> $MAP_FILE for _DMN in $PRESENT_IN_DOMAINS do echo "\ nisLDAPattributeFromField passwd.adjunct.byname,${_DMN}: \\ dn=(\"uid=%s,\", rf_key ), \\ uid=name, \\ userPassword=(\"{crypt}%s\",passwd) " >> $MAP_FILE done fi fi echo ' # This map is never created but yppasswd uses the mapping to extract password # aging information from the DIT. nisLDAPattributeFromField ageing.byname: \ dn=("uid=%s,", rf_key ), \ uid=name, \ shadowLastChange=lastchg, \ shadowMin=min, \ shadowMax=max, \ shadowWarning=warn, \ shadowInactive=inactive, \ shadowExpire=expire, \ shadowFlag=flag # printers.conf.byname nisLDAPattributeFromField printers.conf.byname: \ dn=("printer-uri=%s,", rf_key ), \ printer-name=rf_key, \ (printer-aliases)=(names, "|"), \ sun-printer-bsdaddr=(values, "*bsdaddr=%s:*"), \ (sun-printer-kvp)=(values,":"), \ description=rf_comment # prof_attr nisLDAPattributeFromField prof_attr: \ dn=("cn=%s,", rf_key ), \ cn=name, \ SolarisAttrReserved1=res1, \ SolarisAttrReserved2=res2, \ SolarisAttrLongDesc=desc, \ SolarisAttrKeyValue=attrs # project nisLDAPattributeFromField project.byname: \ dn=("SolarisProjectName=%s,", rf_key ) nisLDAPattributeFromField project.byprojid: \ dn=("SolarisProjectName=%s,", name ), \ SolarisProjectID=rf_searchkey nisLDAPattributeFromField project: \ SolarisProjectName=name, \ SolarisProjectID=projID, \ (memberUid)=(users, ","), \ (memberGid)=(groups, ","), \ (SolarisProjectAttr)=(attrs, ";"), \ description=comment # protocols nisLDAPattributeFromField protocols.byname: \ ipProtocolNumber=number, \ cn=rf_searchkey nisLDAPattributeFromField protocols.bynumber: \ ipProtocolNumber=rf_key, \ description=rf_comment nisLDAPattributeFromField protocols: \ dn=("cn=%s,", name ), \ (cn)=(aliases, " "), \ cn=name # rpc.bynumber nisLDAPattributeFromField rpc.bynumber: \ dn=("cn=%s,", name ), \ oncRpcNumber=rf_key, \ (cn)=(aliases, " "), \ cn=name, \ description=rf_comment # services # services.byservicename rule is only used to speed single search nisLDAPattributeFromField services.byservicename: \ ("%s/%s", cn, ipServiceProtocol) = rf_searchkey nisLDAPattributeFromField services.byname: \ dn=("cn=%s+ipServiceProtocol=%s,", name, protocol ), \ ("*/%s", ipServiceProtocol)=rf_key, \ ("%s/*", ipServicePort)=rf_key, \ (cn)=(aliases, " "), \ cn=name, \ description=rf_comment # timezone.byname nisLDAPattributeFromField timezone.byname: \ dn=("cn=%s,", rf_key ), \ cn=hostName, \ nisplusTimeZone=zoneName, \ description=comment # user_attr nisLDAPattributeFromField user_attr: \ dn=("uid=%s,", rf_key ), \ uid=rf_key, \ SolarisUserAttr=qualifier, \ SolarisUserReserved1=res1, \ SolarisUserReserved2=res2, \ SolarisAttrKeyValue=attrs # publickey.byname nisLDAPattributeFromField keys.host: \ dn=("%s", ldap:dn:?one?("cn=%s", (yp:rf_key, "unix.%s@*"))), \ nisPublicKey=publicKey, \ nisSecretKey=secretKey nisLDAPattributeFromField keys.pass: \ dn=("%s", ldap:dn:?one?("uidNumber=%s", (yp:rf_key, "unix.%s@*"))), \ nisPublicKey=publicKey, \ nisSecretKey=secretKey nisLDAPattributeFromField keys.nobody: \ dn=("uid=%s,",yp:rf_key), \ cn=rf_key, \ nisPublicKey=publicKey, \ nisSecretKey=secretKey # ypservers. This derived from IPlanet implementation not RFC. nisLDAPattributeFromField ypservers: \ dn=("cn=%s,", rf_key), \ cn=rf_key ' >> $MAP_FILE } # # List all the non-default auto.* and custom maps. # list_auto_and_custom_nisLDAPattributeFromField() { # auto.* entries are easy. if [ ${#ALL_DMN_AUTO_CUST_MAPS[*]} -gt 0 ]; then echo "# Non-default custom auto maps (auto.*)\n" >> $MAP_FILE fi for _MAP in ${ALL_DMN_AUTO_CUST_MAPS[*]} do echo "\ # ${_MAP} nisLDAPattributeFromField ${_MAP}: \\ dn=(\"automountKey=%s,\", rf_key ), \\ automountKey=rf_key, \\ automountInformation=value " >> $MAP_FILE done # Since we do not have enough information to generate # entries for other custom maps, best we can do is to # log this map names and ask user to take care of them. ask_user_to_update_the_custom_map_entries_too } # # List mapping of named fields to DIT entries # create_nisLDAPattributeFromField() { [ CUST_CMT_NEEDED -eq 1 ] && echo ' # nisLDAPattributeFromField : It specifies how an LDAP attribute # value is derived from a NIS entries field values. # # The format of nisLDAPattributeFromField entry is : # mapName ":" fieldattrspec *("," fieldattrspec ) ' >> $MAP_FILE # List all the default entries anyway. list_default_nisLDAPattributeFromField # List all the non-default auto.* and custom maps. list_auto_and_custom_nisLDAPattributeFromField echo " # #------------------------------------------------------------------------------ # " >> $MAP_FILE } # # List all the default nisLDAPattributeFromField entries # list_default_nisLDAPfieldFromAttribute() { echo ' # Describe how named fields are mapped from DIT entries. # audit_user nisLDAPfieldFromAttribute audit_user: \ ("uid=%s,*", rf_key)=dn, \ ("uid=%s,*", name)=dn, \ alwaysAuditFlags=SolarisAuditAlways, \ neverAuditFlags=SolarisAuditNever # auto.home nisLDAPfieldFromAttribute auto.home: \ rf_key=automountKey, \ value=automountInformation # auto.master nisLDAPfieldFromAttribute auto.master: \ rf_key=automountKey, \ value=automountInformation # auth_attr nisLDAPfieldFromAttribute auth_attr: \ rf_key=cn, \ name=cn, \ res1=SolarisAttrReserved1, \ res2=SolarisAttrReserved2, \ short_desc=SolarisAttrShortDesc, \ long_desc=SolarisAttrLongDesc, \ attrs=SolarisAttrKeyValue # Exec_attr. Because of messy NIS keys special handlind is required here nisLDAPfieldFromAttribute exec_attr: \ rf_key=("%s:%s:%s",cn,SolarisKernelSecurityPolicy, \ solarisProfileId), \ name=cn, \ policy=SolarisKernelSecurityPolicy, \ type=SolarisProfileType, \ res1=SolarisAttrReserved1, \ res2=SolarisAttrReserved2, \ id=SolarisProfileId, \ attrs=SolarisAttrKeyValue # ethers nisLDAPfieldFromAttribute ethers.byname: \ rf_key=cn nisLDAPfieldFromAttribute ethers.byaddr: \ rf_key=macAddress nisLDAPfieldFromAttribute ethers: \ name=cn, \ addr=macAddress, \ rf_comment=description # bootparams. Must be done after ethers nisLDAPfieldFromAttribute bootparams: \ rf_key=cn, \ params=("%s ", (bootParameter), " ") ' >> $MAP_FILE # group syntax is different when group.adjunct map is present. # So, need to handle the various possibilities _MAP=group.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the group.adjunct syntax in comment form echo '# group nisLDAPfieldFromAttribute group.byname: \ rf_key=cn nisLDAPfieldFromAttribute group.bygid: \ rf_key=gidNumber nisLDAPfieldFromAttribute group: \ gid=gidNumber, \ name=cn, \ ("{crypt}%s", passwd)=userPassword, \ users=("%s,", (memberUid), ",") # # If you are using group.adjunct, comment the group section above # and uncomment the following group and group.adjunct section # # group #nisLDAPfieldFromAttribute group.byname: \ # rf_key=cn #nisLDAPfieldFromAttribute group.bygid: \ # rf_key=gidNumber #nisLDAPfieldFromAttribute group: \ # gid=gidNumber, \ # name=cn, \ # passwd=("#$%s", cn), \ # users=("%s,", (memberUid), ",") # group.adjunct #nisLDAPfieldFromAttribute group.adjunct.byname: \ # rf_key=cn, \ # name=cn, \ # ("{crypt}%s", passwd)=userPassword ' >> $MAP_FILE else # Find the domains in which group.adjunct map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # All the domains have group.adjunct map. echo '# group #nisLDAPfieldFromAttribute group.byname: \ # rf_key=cn #nisLDAPfieldFromAttribute group.bygid: \ # rf_key=gidNumber #nisLDAPfieldFromAttribute group: \ # gid=gidNumber, \ # name=cn, \ # ("{crypt}%s", passwd)=userPassword, \ # users=("%s,", (memberUid), ",") # # If you are not using group.adjunct, comment the group section above # and uncomment the following group and group.adjunct sections # # group nisLDAPfieldFromAttribute group.byname: \ rf_key=cn nisLDAPfieldFromAttribute group.bygid: \ rf_key=gidNumber nisLDAPfieldFromAttribute group: \ gid=gidNumber, \ name=cn, \ passwd=("#$%s", cn), \ users=("%s,", (memberUid), ",") # # group.adjunct nisLDAPfieldFromAttribute group.adjunct.byname: \ rf_key=cn, \ name=cn, \ ("{crypt}%s", passwd)=userPassword ' >> $MAP_FILE else # Not every domain has group.adjunct map. echo "# group" >> $MAP_FILE for _DMN in $PRESENT_IN_DOMAINS do echo "\ nisLDAPfieldFromAttribute group.byname,${_DMN}: \\ rf_key=cn nisLDAPfieldFromAttribute group.bygid,${_DMN}: \\ rf_key=gidNumber nisLDAPfieldFromAttribute group,${_DMN}: \\ gid=gidNumber, \\ name=cn, \\ passwd=(\"#$%s\", cn), \\ users=(\"%s,\", (memberUid), \",\") " >> $MAP_FILE done # Now put the generic group syntax. We do not need to # append the domain name here. echo ' nisLDAPfieldFromAttribute group.byname: \ rf_key=cn nisLDAPfieldFromAttribute group.bygid: \ rf_key=gidNumber nisLDAPfieldFromAttribute group: \ gid=gidNumber, \ name=cn, \ ("{crypt}%s", passwd)=userPassword, \ users=("%s,", (memberUid), ",") ' >> $MAP_FILE # Now we need to put the group.adjunct syntax for domains # in which this map exists. echo "# # group.adjunct # " >> $MAP_FILE for _DMN in $PRESENT_IN_DOMAINS do echo "\ nisLDAPfieldFromAttribute group.adjunct.byname,${_DMN}: \\ rf_key=cn, \\ name=cn, \\ (\"{crypt}%s\", passwd)=userPassword " >> $MAP_FILE done fi fi echo ' # hosts nisLDAPfieldFromAttribute hosts.byaddr: \ rf_ipkey=ipHostNumber nisLDAPfieldFromAttribute hosts.byname: \ (rf_key)=(cn) nisLDAPfieldFromAttribute hosts: \ ("cn=%s+ipHostNumber=*", canonicalName)=dn, \ addr=ipHostNumber, \ aliases=("%s ", (cn) - yp:canonicalName, " "), \ rf_comment=description nisLDAPfieldFromAttribute multihosts: \ ("cn=%s+ipHostNumber=*", canonicalName)=dn, \ (rf_key)=("YP_MULTI_%s", cn), \ aliases=("%s ", (cn) - yp:canonicalName, " "), \ rf_comment=description, \ (tmp)=("%s", ipHostNumber:?one?("(&(cn=%s) \ (ipHostNumber=*.*))", yp:canonicalName)), \ addr=("%s,", (yp:tmp), ",") # ipnodes nisLDAPfieldFromAttribute ipnodes.byaddr: \ rf_ipkey=ipHostNumber nisLDAPfieldFromAttribute ipnodes.byname: \ (rf_key)=(cn) nisLDAPfieldFromAttribute ipnodes: \ ("cn=%s+ipHostNumber=*", canonicalName)=dn, \ addr=ipHostNumber, \ aliases=("%s ", (cn) - yp:canonicalName, " "), \ rf_comment=description nisLDAPfieldFromAttribute multiipnodes: \ ("cn=%s+ipHostNumber=*", canonicalName)=dn, \ (rf_key)=("YP_MULTI_%s", cn), \ aliases=("%s ", (cn) - yp:canonicalName, " "), \ rf_comment=description, \ (tmp)=("%s", ipHostNumber:?one?("(&(cn=%s) \ (ipHostNumber=*:*))", yp:canonicalName)), \ addr=("%s,", (yp:tmp), ",") #mail.aliases nisLDAPfieldFromAttribute mail.aliases: \ rf_key=mail, \ addresses= ("%s,", (mgrprfc822mailmember), ","), \ rf_comment=description #mail.mapping nisLDAPfieldFromAttribute mail.mapping: \ rf_key=mgrprfc822mailmember, \ address=mail, \ rf_comment=description # netgroup. nisLDAPfieldFromAttribute netgroup: \ rf_key=cn, \ (group)=(memberNisNetgroup), \ ("(%s,%s,%s)", host, user, domain)= \ (nisNetgroupTriple), \ rf_comment=description # netid.pass nisLDAPfieldFromAttribute netid.pass: \ number=uidNumber, \ (tmp)=("%s", gidNumber:ou=group,?one?\ ("memberUid=%s", ldap:uid)), \ sgid=("%s,", (yp:tmp) - gidNumber, ","), \ data=("%s,%s", gidNumber, yp:sgid), \ data=gidNumber, \ (rf_key)=("unix.%s@%s", yp:number, yp:rf_domain) # netid.host nisLDAPfieldFromAttribute netid.host: \ ("cn=%s+ipHostNumber=*", data)=dn, \ number=("0"), \ (rf_key)=("unix.%s@%s", yp:data, yp:rf_domain) # netmasks.byaddr nisLDAPfieldFromAttribute netmasks.byaddr: \ ("ipNetworkNumber=%s,*", rf_ipkey)=dn, \ mask=ipNetmaskNumber, \ rf_comment=description # networks. nisLDAPfieldFromAttribute networks.byname: \ (rf_key)=(cn) nisLDAPfieldFromAttribute networks.byaddr: \ ("ipNetworkNumber=%s,*", rf_key)=dn nisLDAPfieldFromAttribute networks: \ name=cn, \ aliases=("%s ", (cn) - yp:name, " "), \ number=ipNetworkNumber, \ rf_comment=description ' >> $MAP_FILE # passwd syntax is different when passwd.adjunct map is present. # So, need to handle the various possibilities _MAP=passwd.adjunct.byname if ! present $_MAP $ALL_DMN_DEF_MAPLIST then # Just put the passwd.adjunct syntax in comment form echo '# passwd nisLDAPfieldFromAttribute passwd.byname: \ rf_key=uid nisLDAPfieldFromAttribute passwd.byuid: \ rf_key=uidNumber nisLDAPfieldFromAttribute passwd: \ name=uid, \ uid=uidNumber, \ ("{crypt}%s", passwd)=userPassword, \ gid=gidNumber, \ gecos=gecos, \ home=homeDirectory, \ shell=loginShell # # If you are using passwd.adjunct, comment the passwd section above # and uncomment the following passwd and passwd.adjunct sections # # passwd #nisLDAPfieldFromAttribute passwd.byname: \ # rf_key=uid #nisLDAPfieldFromAttribute passwd.byuid: \ # rf_key=uidNumber #nisLDAPfieldFromAttribute passwd: \ # name=uid, \ # uid=uidNumber, \ # passwd=("##%s", uid), \ # gid=gidNumber, \ # gecos=gecos, \ # home=homeDirectory, \ # shell=loginShell # passwd.adjunct #nisLDAPfieldFromAttribute passwd.adjunct.byname: \ # rf_key=uid, \ # name=uid, \ # ("{crypt}%s", passwd)=userPassword ' >> $MAP_FILE else # Find the domains in which passwd.adjunct map exists. find_domains $_MAP DEF_MAPS if [ $PRESENT_COUNT -eq $N2L_DMN_CNT ] then # All the domains have passwd.adjunct map. So, put the right # passwd syntax and comment-in the passwd.adjunct syntax. echo '# passwd #nisLDAPfieldFromAttribute passwd.byname: \ # rf_key=uid #nisLDAPfieldFromAttribute passwd.byuid: \ # rf_key=uidNumber #nisLDAPfieldFromAttribute passwd: \ # name=uid, \ # uid=uidNumber, \ # ("{crypt}%s", passwd)=userPassword, \ # gid=gidNumber, \ # gecos=gecos, \ # home=homeDirectory, \ # shell=loginShell # # If you are not using passwd.adjunct, uncomment the passwd section # above and comment the following passwd and passwd.adjunct sections # # passwd nisLDAPfieldFromAttribute passwd.byname: \ rf_key=uid nisLDAPfieldFromAttribute passwd.byuid: \ rf_key=uidNumber nisLDAPfieldFromAttribute passwd: \ name=uid, \ uid=uidNumber, \ passwd=("##%s", uid), \ gid=gidNumber, \ gecos=gecos, \ home=homeDirectory, \ shell=loginShell # # passwd.adjunct Must follow passwd # nisLDAPfieldFromAttribute passwd.adjunct.byname: \ rf_key=uid, \ name=uid, \ ("{crypt}%s", passwd)=userPassword ' >> $MAP_FILE else # Not every domain has passwd.adjunct map. # First put the password syntax with domain name for domains # in which passwd.adjunct exists. echo "# passwd" >> $MAP_FILE for _DMN in $PRESENT_IN_DOMAINS do echo "\ nisLDAPfieldFromAttribute passwd.byname,${_DMN}: \\ rf_key=uid nisLDAPfieldFromAttribute passwd.byuid,${_DMN}: \\ rf_key=uidNumber nisLDAPfieldFromAttribute passwd,${_DMN}: \\ name=uid, \\ uid=uidNumber, \\ passwd=(\"##%s\", uid), \\ gid=gidNumber, \\ gecos=gecos, \\ home=homeDirectory, \\ shell=loginShell " >> $MAP_FILE done # Now put the other passwd syntax. We do not need to # append the domain name here. echo ' nisLDAPfieldFromAttribute passwd.byname: \ rf_key=uid nisLDAPfieldFromAttribute passwd.byuid: \ rf_key=uidNumber nisLDAPfieldFromAttribute passwd: \ name=uid, \ uid=uidNumber, \ ("{crypt}%s", passwd)=userPassword, \ gid=gidNumber, \ gecos=gecos, \ home=homeDirectory, \ shell=loginShell ' >> $MAP_FILE # Now we need to put the passwd.adjunct syntax for domains # in which this map exists. echo "# # passwd.adjunct Must follow passwd # " >> $MAP_FILE for _DMN in $PRESENT_IN_DOMAINS do echo "\ nisLDAPfieldFromAttribute passwd.adjunct.byname,${_DMN}: \\ rf_key=uid, \\ name=uid, \\ (\"{crypt}%s\", passwd)=userPassword " >> $MAP_FILE done fi fi echo ' # This map is never created but yppasswd uses the mapping to extract password # ageing information from the DIT. nisLDAPfieldFromAttribute ageing.byname: \ rf_key=uid, \ name=uid, \ lastchg=shadowLastChange, \ min=shadowMin, \ max=shadowMax, \ warn=shadowWarning, \ inactive=shadowInactive, \ expire=shadowExpire, \ flag=shadowFlag # printers.conf.byname nisLDAPfieldFromAttribute printers.conf.byname: \ rf_key=printer-uri, \ names=("%s|", (printer-aliases), "|"), \ bsdaddr=("bsdaddr=%s", sun-printer-bsdaddr), \ kvps=("%s:", (sun-printer-kvp) - yp:bsdaddr), \ values=("%s:%s", yp:bsdaddr, yp:kvps), \ values=("%s:", yp:bsdaddr), \ values=yp:kvps, \ rf_comment=description # prof_attr nisLDAPfieldFromAttribute prof_attr: \ rf_key=cn, \ name=cn, \ res1=SolarisAttrReserved1, \ res2=SolarisAttrReserved2, \ desc=SolarisAttrLongDesc, \ attrs=SolarisAttrKeyValue # project nisLDAPfieldFromAttribute project.byname: \ rf_key=SolarisProjectName nisLDAPfieldFromAttribute project.byprojid: \ rf_key=SolarisProjectID nisLDAPfieldFromAttribute project: \ name=SolarisProjectName, \ projID=SolarisProjectID, \ comment=description, \ users=("%s,", (memberUid), ","), \ groups=("%s,", (memberGid), ","), \ attrs=("%s;", (SolarisProjectAttr), ";") # protocols nisLDAPfieldFromAttribute protocols.byname: \ ("cn=%s,*", rf_key)=dn, \ (rf_key)=(cn) nisLDAPfieldFromAttribute protocols.bynumber: \ rf_key=ipProtocolNumber, \ rf_comment=description nisLDAPfieldFromAttribute protocols: \ ("cn=%s,*", name)=dn, \ number=ipProtocolNumber, \ aliases=("%s ", (cn) - yp:name, " ") # rpc.bynumber nisLDAPfieldFromAttribute rpc.bynumber: \ rf_key=oncRpcNumber, \ number=oncRpcNumber, \ ("cn=%s,*", name)=dn, \ aliases=("%s ", (cn) - yp:name, " "), \ rf_comment=description # services nisLDAPfieldFromAttribute services.byname: \ rf_key = ("%s/%s", ipServicePort, ipServiceProtocol) nisLDAPfieldFromAttribute services.byservicename: \ (rf_key)=("%s/%s", cn, ipServiceProtocol), \ (rf_key)=(cn) nisLDAPfieldFromAttribute services: \ ("cn=%s+ipServiceProtocol=*", name)=dn, \ protocol=ipServiceProtocol, \ port=ipServicePort, \ aliases=("%s ", (cn) - yp:name, " "), \ rf_comment=description # timezone.byname nisLDAPfieldFromAttribute timezone.byname: \ rf_key=cn, \ hostName=cn, \ zoneName=nisplusTimeZone, \ rf_comment=description # user_attr nisLDAPfieldFromAttribute user_attr: \ ("uid=%s,*", rf_key)=dn, \ ("uid=%s,*", user)=dn, \ qualifier=SolarisUserAttr, \ res1=SolarisUserReserved1, \ res2=SolarisUserReserved2, \ attrs=SolarisAttrKeyValue # publickey.byname nisLDAPfieldFromAttribute keys.host: \ ("cn=%s+ipHostNumber=*", cname)=dn, \ rf_key=("unix.%s@%s", yp:cname, yp:rf_domain), \ publicKey=nisPublicKey, \ secretKey=nisSecretKey nisLDAPfieldFromAttribute keys.pass: \ rf_key=("unix.%s@%s", uidNumber, yp:rf_domain), \ publicKey=nisPublicKey, \ secretKey=nisSecretKey nisLDAPfieldFromAttribute keys.nobody: \ rf_key=uid, \ publicKey=nisPublicKey, \ secretKey=nisSecretKey # ypservers. This derived from IPlanet implementation not RFC. nisLDAPfieldFromAttribute ypservers: \ rf_key=cn ' >> $MAP_FILE } # # List all the non-default auto.* and custom maps. # list_auto_and_custom_nisLDAPfieldFromAttribute() { # auto.* entries are easy. if [ ${#ALL_DMN_AUTO_CUST_MAPS[*]} -gt 0 ]; then echo "# Non-default custom auto maps (auto.*)\n" >> $MAP_FILE fi for _MAP in ${ALL_DMN_AUTO_CUST_MAPS[*]} do echo "\ # ${_MAP} nisLDAPfieldFromAttribute ${_MAP}: \\ rf_key=automountKey, \\ value=automountInformation " >> $MAP_FILE done # Since we do not have enough information to generate # entries for other custom maps, best we can do is to # log this map names and ask user to take care of them. ask_user_to_update_the_custom_map_entries_too } # # List mapping of named fields from DIT entries # create_nisLDAPfieldFromAttribute() { [ CUST_CMT_NEEDED -eq 1 ] && echo ' # nisLDAPfieldFromAttribute : It specifies how a NIS entries # field values are derived from LDAP attribute values. # # The format of nisLDAPfieldFromAttribute is : # mapName ":" fieldattrspec *("," fieldattrspec) ' >> $MAP_FILE # List all the default entries anyway. list_default_nisLDAPfieldFromAttribute # List all the non-default auto.* and custom maps. list_auto_and_custom_nisLDAPfieldFromAttribute echo " # #------------------------------------------------------------------------------ # " >> $MAP_FILE } # Main function for creating the mapping file create_mapping_file() { # Ask user the list of domains to be served by N2L create_n2l_domain_list # If there are no N2L domains or none selected, then exit if [ $N2L_DMN_CNT -eq 0 ]; then echo "There are no domains to serve. No mapping file generated." return 1 fi while : do get_ans "Enter the mapping file name (h=help):" "${MAP_FILE}" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg new_mapping_file_name_help ;; * ) break ;; esac done MAP_FILE=${ANS} [ $DEBUG -eq 1 ] && MAP_FILE = $MAP_FILE # Backup existing mapping file if selected check_back_mapping_file # To prevent from leaving a partial mapping file in case some error # or signal takes place which might result in machine starting in N2L # mode at next reboot, store the output being generated in a temporary # file first, and move it at the final destination only at the end if # everything goes fine. _MAP_FILE=$MAP_FILE MAP_FILE=${TMPDIR}/${TMPMAP}.$$ echo "Generating mapping file temporarily as \"${MAP_FILE}\"" # Place copyright information put_mapping_file_copyright_info # Prepare various map lists for each domain create_map_lists # List domains and contexts get_nisLDAPdomainContext # List domains for which passwords should be changed get_nisLDAPyppasswddDomains # List databaseId mappings (aliases) create_nisLDAPdatabaseIdMapping # List comment character for maps create_nisLDAPcommentChar # List SECURE and INTERDOMAIN flags create_nisLDAPmapFlags # List TTL values create_nisLDAPentryTtl # List name fields create_nisLDAPnameFields # List split fields and repeated fields seperators. create_split_field_and_repeatedfield_seperators # List association of maps with RDNs and object classes. create_nisLDAPobjectDN # List mapping of named fields to DIT entries create_nisLDAPattributeFromField # List mapping of named fields from DIT entries create_nisLDAPfieldFromAttribute # We are done, so move back the mapping file from temp. location # to actual location. # In case the mapping file name has a directory component which does # not exist, then create it now, otherwise 'mv' will return error. DIR_TO_CREATE=`dirname ${_MAP_FILE}` mkdir -p ${DIR_TO_CREATE} echo "Moving output from temporary file ($MAP_FILE) to actual file ($_MAP_FILE)" mv $MAP_FILE $_MAP_FILE # Revert back the mapping file name in case needed. MAP_FILE=$_MAP_FILE echo "Finished creation of mapping file ( $MAP_FILE )" } # # Main function for creating config file (ypserv) # process_config_file() { # Ask for confirmation if the file name is not specified. if [ $CONFIG_FILE_SPECIFIED -eq 0 ]; then display_msg no_config_file_name_specified get_confirm_nodef "Do you want to create the config file (y/n) ?" [ $? -eq 0 ] && return 0 while : do get_ans "Enter the config file name (h=help):" "${CONFIG_FILE}" # If help continue, otherwise break. case "$ANS" in [Hh] | help | Help | \?) display_msg new_config_file_name_help ;; * ) break ;; esac done CONFIG_FILE=${ANS} [ $DEBUG -eq 1 ] && CONFIG_FILE = $CONFIG_FILE fi # Backup existing config file if selected check_back_config_file # Create config file create_config_file } # # Main function for creating mapping file (NISLDAPmapping) # process_mapping_file() { # Ask for confirmation if the file name is not specified. if [ $MAPPING_FILE_SPECIFIED -eq 0 ]; then display_msg no_mapping_file_name_specified get_confirm_nodef "Do you want to create the mapping file (y/n) ?" [ $? -eq 0 ] && return 0 fi # Create mapping file create_mapping_file } ########################################### ########### MAIN ########### ########################################### PROG=`basename $0` # Program name ABS_PROG=$0 # absolute path needed # Only superuser should be able to run this script. is_root_user if [ $? -ne 0 ]; then echo "ERROR : Only root can run $PROG" exit 1 fi # Initialize things init # Parse command line arguments. parse_arg $* # Create config file (ypserv) process_config_file # Create mapping file (NISLDAPmapping). process_mapping_file # Cleanup temp files and directories unless debug. [ $DEBUG -eq 0 ] && cleanup exit 0